digital-forensics.de
As you may have noticed I’m currently only blogging about computer forensics and cybercrime investigations only at digital-forensics.de / computer-forensik.org. So please come over there and read on my dear.
Schlagwort: digital forensics
3rd edition of my book
3rd Edition of “Computer-Forensik. Computerstraftaten erkennen, ermitteln, aufklären.” The new revised edition of my book on computer forensics in German language is available. For detailed information and the TOC check out computer-forensik.org or go directly to amazon.
computer forensics workshops in Berlin and Frankfurt
In collaboration with the german IT journal iX I’m going to give again computer forensics lessons in Frankfurt and Berlin.
Certified Wireless Analysis Professional Official Study Guide
The Certified Wireless Analysis Professional Official Study Guide is now free available for download. Very useful if you have to analyse wireless captures. Please take a look at the content:
The Sleuthkit 2.10
A new version of The sleuthkit (TSK) is out now. There are some minor bug fixes included. Changelog
WTF is Microsoft doing with the Last Access Timestamp on Vista?
I recently discovered, that Microsoft destroyed a most valuable digital forensics evidence source on NTFS filesystems with Vista. The default registry key value for HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet \ Control\FileSystem\NtfsDisableLastAccessUpdate is now „1“, which means no last access timestamp will be written at all. On Windows XP and Windows 2000
More on Windows Local Kernel-mode Backdoor Techniques
On uninformed.org you can find a whitepaper which describes several ways to get your code covertly executed in the Windows kernel.
Booting EnCase Images
GetData now bundles their forensics tool MountImage Pro v2 with Virtual Forensic Computing (VFC) from MD5 Ltd. You can now mount a forensic image
Sector Inspector (SecInspect.exe)
Microsoft published a tool called Sector Inspector (SecInspect.exe) with the Windows 2003 Server Resource Kit. This is a command-line diagnostics tool that allows administrators to view the contents of master boot records, boot sectors, and IA64 GUID partition tables. Additional features
The Sleuthkit 2.08
The Sleuthkit (TSK) 2.08 is out now. The new version contains