Daily Blog #641: Forensic Lunch 3/8/19 Eric Zimmerman Lee Whitfield

Hello Reader,

          Today the Forensic Lunch returned! This week we had:

• Eric Zimmerman talking about KAPE
• How KAPE works
• How you can use it
• How to automate it
• How you can extend it
• Lee Whitfield went through all of the nomination categories for this years Forensic 4Cast awards. We also covered the rules of nominating people!

You can watch the video here:

Also Read:  Regipy - A New Python Windows Registry Forensics Library

Read More

Daily Blog #601: Live Registry Triage and Testing

Hello Reader,
          Well I attempted to do a test kitchen tonight but VMWare Workstation didn't want to cooperate. What I wanted to show is summarized in the below blog post from Eric Zimmerman:

https://binaryforay.blogspot.com/2019/01/locked-file-support-added-to.html

Eric has added the ability for his registry tools and the MFT explorer to be able to access the locked live files running on the live system. This means you can now access shellbag data with dates, view and search registries, parse amcache hives, run registry plugins and parse MFTs all without imaging or extracting files from the live system.

This is a pretty big step and it will require running the programs as the administrator in order to access the raw disk. I hope you take a moment to give them a spin as I will when I get a VM to boot!

Also Read: Daily Blog #600

Read More

Daily Blog #560: Forensic Lunch 12/7/18 - RBCMD, MFTEcmd, $BOOT, and More

Hello Reader,
        This week we had a Forensic Lunch with Eric Zimmerman! We talked about

• Eric's new tool RBCMD 
• Eric's updated MFTEcmd which now supports $BOOT, $SDS, and USN Journal parsing 

• Eric's soon to be released plugins for the CIT registry key and the Syscache hive

You can watch the video here:

Also Read: Daily Blog #559 

Read More