They shared an article by Filippo Valsorda “on how to install and un-encrypt hard drives on Macs”.They shared an article by David Balaban containing a “comprehensive report on ransomware-related events covering a time frame of May 2016 – March 2017”.They shared an article by Salvation Data on “cellphone audio file data extraction”.Įxtracting Audio Messages from Instant Messengers.They shared an article by AArti Singh on Raj Chandel’s Blog on how to “Capture VNC Session of Remote PC using SetToolkit”.They shared a playbook by the Microsoft Advanced Threat Analytics Team on “How to simulate and detect attacks with the Advanced Threat Analytics Playbook”.They shared an intrusion detection checklist on Linux by Balaji N at “Gbhackers on Security”.The guys at Digital Forensics Corp shared a number of articles this week.How to find data hidden at the end of an OLE file Philippe outlines a method that he has implemented that works for some use cases but not others (ie modifying the last FAT records), and indicates that he plans to address this case in the next version of olemap. Philippe Lagadec was asked by Didier Stevens to “add a method to olefile that returns bytes that are appended to an OLE file”, and accepted the challenge.Igor Shorokhov & Oleg Skulkin at Cyber Forensicator dynamically analyse a maldoc containing malicious VBScript files.īasic Dynamic Analysis of a Malicious VBScript.The challenge provided a memory dump of an Android device along with the task to retrieve some encrypted information from it.” Alex Joss’s writeup related to a challenge “about memory forensics on Android devices. Daniel Berger at Compass Security gives his rundown of the Insomnihack conference, as well as links the writeups of the CTF challenge.He has also adding the extra data into his fork of PoorBillionaire’s Windows Prefetch Parser, and I imagine other tool developers will be updating their tools shortly as well. He has provided both a high level overview, as well as the technical details of his findings. James Habben at 4n6ir has been busy digging into the internals of Prefetch files.If you’d like to vote this site for blog of the year, that would be greatly appreciated 🙂Ģ017 Forensic 4:cast Awards – Voting FORENSIC ANALYSIS Thank you to everyone who nominated this blog, as a result it was one of the top three, and therefore able to be voted for! Nominations for the 2017 Forensic 4Cast Awards closed during the week, but Lee has tallied the nominations and voting is now open until May 31.

Dvr examiner software trial download