The Forensic Lunch!
The one hour, mostly, live digital forensics and incident response focused video cast and podcast.
php/* */ ?>
The Forensic Lunch!
The one hour, mostly, live digital forensics and incident response focused video cast and podcast.
Copyright: © Copyright 2016 G-C Partners, LLC
Live from CEIC. Ben LeMere from Berla, Jeff the Product Evanglist from Guidance Software, Amber Shroader from Paraben, and more!
The you should have filed your taxes edition!This week is all about the Forensic 4cast awards. We cover all of the nominees and make our official votes.
The thank goodness April Fools day is over editionGuests this week:Devon Kerr talking about his work at Mandiant/Fireeye and his research into WMI for both IR and attacker usage.You can email Devon here: devon.kerr@mandiant.comand you can follow him on twitter here: https://twitter.com/_devonkerr_Get cool tools from the Mandiant github here: https://github.com/mandiantWatch Devon talk more about WMI and IR at the SANS DFIR Summit: http://dfir.to/1BvOw7G Matthew and I going into the Automating DFIR series and our upcoming talk at CEICWe are on the CEIC agenda here:https://www.guidancesoftware.com/ceic...
We had another great Forensic Lunch! This broadcast we had:James Carder of the Mayo Clinic, @carderjames, talking all about automating your response process to separate the random attacks from sophisticated attacks. You can hear James talk about this and much more at the SANS DFIR Summit where he'll be a panelist! If you want to work with James Mayo Clinic is hiring.Mayo Clinic Infosec and IR Jobs: http://www.mayo-clinic-jobs.com/go/in...Contact James Carder: carder.james@mayo.eduSpecial Agent Eric Zimmerman of the FBI, @EricRZimmerman , talking about his upcoming in depth Shellbags talk at the SANS DFIR Summit as well as his new tool called Registry Explorer. RE and Eric's research into windows registries will be continued in the next broadcast. Whether you are interested in registries from a research, academic or investigative perspective this is a must see, and FREE, tool!Eric's Blog: http://binaryforay.blogspot.com/Eric's Github:https://github.com/EricZimmermanRegistry Explorer: http://binaryforay.blogspot.com/p/sof...
Guests this broadcast:Ben LeMere of Berla talking about Vehicle Forensics, Embedded Systems, Cam bus networks and all the fun he's been having with doing forensics on car entertainment systems. You may be very surprised but what he has to say!Lee Whitfield talking about Superfish, what happened and what you need to know. Robin Keir of Crowdstrike talking about his research and role at Crowdstrike, specifically Superfetch and CrowdResponseShow linksBen LeMereWebsite: http://Berla.coTwitter: @BenLeMereLee WhitfieldForensic 4cast Award Nominations:https://forensic4cast.com/forensic-4c...Twitter: @lee_whitfieldRobin KeirWebsite: http://www.crowdstrike.com/Crowd Response:http://www.crowdstrike.com/community-...Twitter: @RobinKeir
The after Thanksgiving Hangover edition:
This week we had Eric Zimmerman, @ericrzimmerman, talking about Shellbags, his tool Shellbag explorer and our research into new things we can determine from them.
We had an interesting Forensic Lunch today with:Rob Fuller, @mubix, talking about his new project, project mentor http://www.projectmentor.net/ where Rob is offering to help mentor you into developing the real technical skills in infosec and dfir to get into the industry and other noble aspirations.David Dym, @dave873, talking about the latest version of Metadiver which is available to download at http://www.easymetadata.com/wp/ which can crawl a directory and pull out all the metadata it can find into xls, json, xml and other formats. He also makes shadowkit.Kevin Stokes talking about how to extend and expand our USB Multiboot Dongle, you can download the dongle image here: https://mega.co.nz/#!i45WhQya!SQILk0T...Zoltan Szabo, talking about his stance on Digital Forensics as a science.You can email him at zoltandfw@gmail.com if you want to give your feedback to his opinions.
This week with:Yogesh Kahtri talking about his Windows 8 registry forensics research (You can read it here http://www.swiftforensics.com/ and email him yogesh@swiftforensics.com)
Dan Pullega talking about his extensive research into Windows Shellbags (http://www.4n6k.com/2013/12/shellbags... and email Dan at dan.pullega@gmail.com)
David Dym talking about his new tool MetaDiver (You can download it here http://www.easymetadata.com/wp/)
and Matthew and myself talking about v3 of ANJP and demoing the auto detection of CD Burning.
Robert Haist, talking about his research with page_brute in recovering command execution and other fun things from the pagefile, read his blog about it here: http://blog.roberthaist.com/2013/12/r...Amber Shroader, talking about Device Seizure 6.5 and a great discussion on what happens behind the scenes in your mobile forensics tools as well as the future of cloud phone data acquisition. You can find out more about Device Seizure here: http://www.paraben.com/device-seizure...
Joakim Schicht, discussing his tools and research, including how he approaches these projects and develops them. You can find his google code repository here: http://code.google.com/p/mft2csv/ with all the tools mentioned today and more!