Daily Blog #700: New version of Plaso

Hello Reader,

          Ryan Benson's #130 Daily DFIR tweet mentioned something I think is interesting:

He pointed out that there is a new version of Plaso out which by itself is good news but whats interesting is that they have now switched to libfsntfs for NTFS parsing.

Why is that interesting?

Every previous version of Plaso and DFVFS backed tools made use of the TSK's native support for NTFS. Libfsntfs is Metz's NTFS library that he wrote to handle all of the edge case NTFS conditions he found, provide faster speeds and extend what is possible with supports for things like case sensitive entries, which in NTFS is interesting all by itself.

I think we should have a look at this library wednesday. Why not tomorrow? Tomorrow is when we do Magnet Virtual CTF commentary live on Youtube!

Also Read: Daily Blog #699

Read More

Daily Blog #683: Forensic Lunch 4/24/20 with the Google IR Team (GRR, Timesketch, Turbinia, DTTimewolf, More!)

Hello Reader,
      We had a jam packed Forensic Lunch today with a portion of the Google IR team today talking all about the open source tools they develop, use and support in their work at Google.

Specifically we had :

• Mikhail Bushkov giving a big update on GRR https://github.com/google/grr
• Johan Berggren (https://twitter.com/jberggren) and Kristinn Gudjonsson (https://twitter.com/el_killerdwarf) talking about Timesketch and Data science
• https://github.com/google/timesketch
• Aaron Peterson (https://twitter.com/aarontpeterson) talking about Turbinia
• https://github.com/google/turbinia
• Thomas Chopitea (https://twitter.com/tomchop_) talking about DTTimewolf
• https://github.com/log2timeline/dftimewolf
• Theo Giovanna talking about libcloudforensics aka cloudforensicutils
• https://github.com/google/cloud-forensics-utils/tree/master/libcloudforensics
• Joachin Metz (https://twitter.com/joachimmetz) - Talking about Plaso, libntfs and Libyal
• Plaso: https://github.com/log2timeline/plaso 
• Libfsntfs: https://github.com/libyal/libfsntfs
• Libyal: https://github.com/libyal

Join them on the Open Source DFIR Slack: https://join-open-source-dfir-slack.herokuapp.com/

Read more about what they are doing on the Open Source DFIR Blog: https://osdfir.blogspot.com/

Watch the video below

Also Read: Daily Blog #682 - Linux Kernel Patches for Safe Forensic Imaging

Read More