Digital Forensic Survival Podcast

Latest Episodes:

DFSP # 319 - Shellbags Mar 29, 2022

Show notes

This week is a back to basics episode where I am going to cover Windows shellbags. This is a core Windows artifact that gets included in pretty much most every file use and knowledge investigation or any investigation where you’re looking to tie a specific account to directory access activity. Like most Windows artifacts you must know how user interaction affects the artifact in order to properly interpreted it as evidence. You must also be aware of any caveats or pitfalls that may affect your evidence. Spoiler alert, there is a huge one associated with Windows shellbags that I’ll cover at the end of the episode-it’s nothing new but if you’re unfamiliar with it you definitely need to know about it.

DFSP # 318 - Rust and Chainsaw Mar 22, 2022

Show notes

This week I am talking about a program language called rust and the advantages it has for DFIR analyst. I’m also covering Chainsaw, a toolset that you can use for Windows event log analysis.

DFSP # 317 - UserAssist Mar 15, 2022

Show notes

This week it’s back to basics with a Windows artifact for tracking program execution. I’m covering the user assist key which is a mainstay for both live triage and dead box forensics. This artifact is useful for profiling system usage, identifying malware, and general file use and knowledge applications. There are some caveats you need to be aware of and in this episode I’m covering five different experiments to document the effects that different types of user activity had on the artifact. If you want to better understand this artifact and how to work with it stay tuned.

DFSP # 316 - Cloud Traffic Security Mar 08, 2022

Show notes

This week I am covering how different common protocols are secured in the cloud. Part of your effectiveness as a security analyst is your knowledge and understanding of how environments work in a typical scenario. I know that all environments are different but there is some foundational knowledge that you can learn that will be useful no matter what environment you’re working. My goal with this episode is to provide you with a better understanding of how insecure protocols are handled in cloud environments.

DFSP # 315 - ARTHIR Mar 01, 2022

Show notes

This we can talk about Arthir, an open source platform for windows incident response and threat hunting.

DFSP # 314 - Future of Cyber Security Feb 22, 2022

Show notes

This week Max Lamothe-Brassard talks about the future of cyber security.

DFSP # 313 - Shimcache and Amcache Feb 15, 2022

Show notes

This week is a back to basic episode featuring Shimcache and Amcache. Learn what they are, why they are important to many investigations and the pitfalls to avoid.

DFSP # 312 - Cloud Network Security Services Feb 08, 2022

Show notes

This week is about Cloud Network Security Services.

DFSP # 311 - Data Spoliation Fast Triage Feb 01, 2022

Show notes

This week we continue with the Windows fast triage series and talk about data spoliation detection.

DFSP # 310 - Cloud Network Segmentation Jan 25, 2022

Show notes

This week is about cloud network segmentation. Network segmentation has security advantages, and that’s regardless of whether or not security is the intention. There are some big differences between traditional on-prem network segmentation and cloud infrastructure segmentation. As a DFIR practitioner, knowing the difference is vital for your incident response preparedness. This week I will break it down from a DFIR point of view and provide some necessary insight that will help you better structure your investigations involving cloud assets.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Digital Forensic Survival Podcast

Related Podcasts

Links

Stay Connected