Digital Forensic Survival Podcast

Latest Episodes:

DFSP # 239 - Registry Persistence Part 1 Sep 15, 2020

Show notes

This week I talk about examining the Windows Registry for evidence of persistence.

DFSP # 238 - Bash Attacks Sep 08, 2020

Show notes

This week I talk about the use of Bash commands in crypto-mining attacks.

DFSP # 237 - Attack Shimming Sep 01, 2020

Show notes

This week I talk about detecting persistence via Attack Shimming artifacts.

DFSP # 236 - Apple FSEvents Aug 25, 2020

Show notes

This week I interview Steve Whalen of SUMURI about Apple FSEvent artifacts. Learn what they are and how to leverage them for investigations.

DFSP # 235 - Scheduled Task Change Aug 18, 2020

Show notes

This week I talk about examining Windows Scheduled Task change events for evidence of persistence.

DFSP # 234 - Divide & Conquer with Brian Carrier Aug 11, 2020

Show notes

This week I interview Brian Carrier, SVP & CTO of Basis Technology about his "Divide & Conquer" approach to DFIR investigations.

DFSP # 233 - New Scheduled Tasks Aug 04, 2020

Show notes

This week I talk about examining Windows New Scheduled Task events for evidence of persistence.

DFSP # 232 - Exam Process - Soup-to-Nuts Jul 28, 2020

Show notes

This week Chris of MSAB shares his recommended process for DFIR exam standardization.

DFSP # 231 - Service Change Triage Jul 21, 2020

Show notes

This week I talk about examining Windows Service modification events for evidence of persistence.

DFSP # 230 - User Activity Artifacts Jul 14, 2020

Show notes

This week I talk about the artifacts and methodology for examining user activity on Windows systems.