SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

WACCI Digital Forensics (Part 1)

This week, I had the pleasure of attending the Wisconsin Association of Computer Crime Investigators (WACCI) conference in Madison, WI. I was fortunate to be accompanied by good friend and fellow SANS Computer Forensics blog author Brad Garnett. The following is a recap of our time at the conference.

When I first learned about the WACCI conference, I was immediately interested in attending. The biggest draw was the speaker lineup, which included such forensics luminaries as Ovie Carroll, Harlan Carvey, Rob Lee, Brian Carrier and Mark McKinnon. That's quite a list of talent. I was amazed that such a great conference could be given while still keeping the registration price incredibly low. Finally, I was attracted by the conference location. Given that I live in a rural area, it was great to see a high quality forensics conference taking place within realistic driving distance. Once I was certain


Digital Forensics Case Leads: Free tools, Treasure Hunts, Drive-by Attacks and Spying

This week's Case Leads features two free tools from AccessData and Paraben Corporation, a digital (forensics) treasure hunt to test your skills, spying, drive-by (browser) attacks and consequences resulting from Stuxnet.

As always, if you have an interesting item you think should be included in the Digital Forensics Case Leads posts, you can send it to


  • Earlier this month AccessData released a new version of their popular (and free) utility, the FTK Imager. Version 3 has a number of useful features such as the ability to boot forensic images in VMWare and the ability to mount AFF, DD, E01, and S01 image formats as physical devices or logical drive letters. The latest version of the application also supports HFS+, VxFS (Veritas File System), exFAT, EXT4, Microsoft's VHD (Virtual Hard Disk) and compressed and uncompressed DMG


Review: Mandiant's Incident Response Conference (MIRCon) Day 1

I have the good fortune this week of being able to attend Mandiant's Incident Response Conference (MIRcon) in Alexandria, Virginia, and so far it's a very good time. For those who couldn't attend, or who may have chosen instead to attend that other conference that's going on right now, I thought I'd blog a few impressions and take aways both to solidify the day in my own mind and provide some food (and flavor) for thought. This won't be a comprehensive, presentation-by-presentation summary, but rather an overview with focus on what I consider to be some of the highlights. And if you weren't at MIRcon today, the single most important highlight you missed was Richard Bejtlich simultaneously coining a new phrase and inventing a new psychological diagnosis: "

3 Phases of Malware Analysis: Behavioral, Code, and Memory Forensics

When discussing malware analysis, I've always referred to 2 main phases of the process: behavioral analysis and code analysis. It's time to add a third major component: memory analysis.

Here's a brief outline of each phase:

  • Behavioral analysis examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes and OS components. As the malware investigator notices interesting behavioral characteristics, he modifies the laboratory environment to evoke newcharacteristics. To perform this work, theinvestigatortypically infects the isolated system while having the necessary monitoring tools observe the specimen's execution. Some of the free tools that can help in this analysis phase are Process Monitor,

Affidavit as Support for an Investigation

An affidavit can be a vital tool in any type of investigation, whether the investigation be forensic, internal, criminal, regulatory, incident response or otherwise. As an investigator gathers facts, he will often interview witnesses, and obviously the investigator is wise to make records of the interviews (written notes or even audio/video records). But sometimes it is prudent to take an additional step in securing what a witness has to say.

I recently advised an investigation where numerous witnesses had much to say. But as I assessed all that was being said, a particular statement of one certain witness stood out as crucial to the outcome of the case. I recommended that witness record her statement in an affidavit.

An affidavit is a formal, written document that memorializes a declaration of facts by a witness. The preparation and execution of an affidavit can help to lock down a complete and careful statement of what the witness has to say. An affidavit

... Continue reading Affidavit as Support for an Investigation