new linux incident response script
We updated the ForensiX Linux Incident Response Script. You can find the new version at
Schlagwort: Live Response
frozen memory aquisition
Cool stuff from Princeton researchers. They published a paper „Cold Boot Attacks on Encryption Keys“ and showed that whole disk encryption can be defeated by relatively simple methods. They demonstrated their methods by using them to defeat three disk encryption products: BitLocker,
New Forensics Live Response CD published
I’m proud to announce, that my team published yesterday a very cool Live Response CD for Linux and Windows in cooperation with the german journal iX. It contains a brand new Linux Live Response script and a build script for your own static binaries. This Live Response Script contains also an
Booting EnCase Images
GetData now bundles their forensics tool MountImage Pro v2 with Virtual Forensic Computing (VFC) from MD5 Ltd. You can now mount a forensic image
Malware Analysis with PEiD
I’d like to comment on PEiD. If you have to analyse an unknown binary and you like to know some details about packers, compilers and crypto features, you should give PEiD a try.
FSP/FRU File Copy Client released
Harlan Carvey just released the FSP/FRU File Copy Client on SourceForge. The FCli is a GUI client that the investigator can use to select files to be copied from the suspect system, over to the FSP server.
Live View released
Brian Kaplan from Carnegie Mellon University just released a tool called Live View. With Live View you can convert a raw dd image or physical device to a VMware virtual machine.
Forensic memory dumping issues
Arne Vidstrom from ntsecurity.nu wrote an interesting paper about problems with forensic RAM dumps from Windows XP. His summary on this topic
windows memory analysis
Andreas Schuster recently published on his blog two interesting articles about process memory reconstruction. He describes how to