Forensics Archives - Seite 2 von 6

frozen memory aquisition

Posted onFreitag, 22. Februar 2008

Cool stuff from Princeton researchers. They published a paper „Cold Boot Attacks on Encryption Keys“ and showed that whole disk encryption can be defeated by relatively simple methods. They demonstrated their methods by using them to defeat three disk encryption products: BitLocker,

Insider Threat Research

Posted onMontag, 28. Januar 2008Dienstag, 5. Februar 2008

CERT and the United States Sectret Service published an insider threat research that focuses on both technical and behavioral aspects of actual compromises. The key findings are Current and former employees carried out insider activities in nearly equal numbers. Sixty-three percent of the insiders held technical positions within the targeted organizations.

Talk about Windows Vista Forensics

Posted onSamstag, 29. Dezember 20072 Comments

I’m going to talk about Windows Vista Forensics at the DFN-CERT workshop. The workshop will be held on Februray 13 and 14, 2008 in Hamburg, Germany.

The Sleuthkit 2.10

Posted onDonnerstag, 13. Dezember 2007Donnerstag, 13. Dezember 20071 Comment

A new version of The sleuthkit (TSK) is out now. There are some minor bug fixes included. Changelog

WTF is Microsoft doing with the Last Access Timestamp on Vista?

Posted onDienstag, 20. November 2007Donnerstag, 22. November 20072 Comments

I recently discovered, that Microsoft destroyed a most valuable digital forensics evidence source on NTFS filesystems with Vista. The default registry key value for HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet \ Control\FileSystem\NtfsDisableLastAccessUpdate is now „1“, which means no last access timestamp will be written at all. On Windows XP and Windows 2000

More on Windows Local Kernel-mode Backdoor Techniques

Posted onSamstag, 10. November 20071 Comment

On uninformed.org you can find a whitepaper which describes several ways to get your code covertly executed in the Windows kernel.

computer forensics beginners course

Posted onSonntag, 26. August 2007Samstag, 19. Januar 2008

I’m giving computer forensics classes for beginners in Munich, Frankfurt and of course Berlin.

new theme on computer-forensik.org

Posted onSamstag, 18. August 20071 Comment

I remodeled my other digital forensics related german website http://computer-forensik.org. It has now a fancy brand new theme. 😉

Oracle Database Forensics

Posted onDienstag, 14. August 2007

David Litchfield from NGSSoftware published some new material about Oracle Database Forensics.

Good Practice Guide for Computer-Based Electronic Evidence

Posted onDienstag, 31. Juli 2007Montag, 6. August 20071 Comment

The english Association of Chief Police Officers (ACPO) has released a new guide to collecting electronic evidence. The Good Practice Guide for Computer-Based Electronic Evidence has been revised by experts.