SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Digital Forensics Case Leads: Make it go away, the Stuxnet extended remix

Life is busy in the digital forensics and incident response world, so this week's Case Leads is short and sweet. Here are my favorite items from the last few days, enjoy!

If you have an interesting item you think should be included in the Digital Forensics Case Leads posts, you can send it to caseleads@sans.org.

Tools:

  • Harris Corporation introduces BlackJack a USB device that looks very useful for situations where one must rapidly triage systems for the presence of interesting data. According to the press release, the device boots in less than three seconds and "automatically scans and copies data by prioritizing search criteria and securely partitions search results for analysis." The device has two LEDs, one red and one green that indicate the presence or absence of items of interest.

Good Reads:


6 Hex Editors for Malware Analysis

Hex editors allow examining and modifying a file at the low-level of bytes and bits, usually representing the file's contents in hexadecimal form. Some editors distinguish themselves at helping the user derive meaning from the examined file, extracting ASCII and Unicode contents, searching for patterns, recognizing common structures, and so on. There are lots of hex editors out there; I want to mention a few that I find particularly useful for analyzing malware and examining malicious document files.

FileInsight

FileInsight is a free hex editor from McAfee Labs that runs on Microsoft Windows (download zip file). As expected, it can perform

...


SANS Reverse Engineering Malware in London (Forensics 610)

One of the our most popular classes is returning to London in December. Forensics 610: Reverse Engineering Malware has been selling out in the United States and is in high demand. As organizations grow the need to analyze and reverse complex malware is extremely important.

Many organizations in the United States are using fulltime malware analysts as a core part of their teams helping identify compromised systems by specifying exactly what type of traffic or what digital forensic footprint a piece of malware leaves on a machine. No longer will an organization have to "guess" where to look. With a malware analyst on their team, it makes it much easier to use actionable intelligence in order to find the hackers on your

...


How To - Digital Forensics Copying A VMware VMDK

Having recently seen a number of requests on the security and forensic list servers that I participate in requesting recommendations / procedures for copying the disk (VMDK) for a specific Virtual Machine (VM) within a VMware environment for analysis in an incident response, I put together a quick How To in effort to provide some insight in to a few of the methods that I have used.

The Game Has Clearly Changed With Virtualization

Most often the files associated with a given VM are not stored locally on the physical server running ESX or ESXi and the respective VM. It is important to understand that in order to use many of the more powerful features of VMware such as vMotion and DRS the files for the VM's must reside on shared storage that is reachable from each ESX or ESXi server that needs to interact with it. Hence, when

...


SANS Digital Forensics Blog Reader's Survey

The contributors to the SANS Digital Forensics Blog want to say "thank you," and to get some feedback from you on the future direction of the blog. Please take a few minutes to complete our reader survey.

The blog has seen a 606% increase in traffic over the last year (Thank You!!), logging over 255,000 unique visits, and 67% of those being new visitors! Those are some great numbers that we are very proud of and we continue to strive to be a leading contributor to the digital forensics community. Our blog authors and contributors come from all walks of life in the digital forensics profession and are leading practitioners in their organizations.

Some of our most viewed articles include:

Recovering Deleted Text Messages from Windows Mobile Devices by

...