The Forensic Lunch!
The one hour, mostly, live digital forensics and incident response focused video cast and podcast.
php/*
The Forensic Lunch!
The one hour, mostly, live digital forensics and incident response focused video cast and podcast.
Copyright: © Copyright 2016 G-C Partners, LLC
Lee Whitfield comes on to talk about the Forensic 4Cast awards which are now taking nominations.
Jonathan Poling came on to talk about his new blog and his work at Secureworks
Friend of the show Eric Zimmerman is back to talk about updates to his tools and research
Davida and I talk about whats new in our research, tools and packages
Michael Gough talking with us about his tool LOG-MD and his work.
We also go into SRUM again showing new data we can correlate within it.
This episodes is all about Hibernation files and Mark Spencer's company Arsenal Consulting research into it that led to the creation of a new tool called Hibernation Recon.
Live broadcast from OSDF Con 2016
Talking about DCITA, Autopsy and the academic program that Mark McKinnon is running at Davenport.
Sorry about the audio on this one, we had a bad upstream.
The forensic lunch! The twice a month live videocast/podcast all about #DFIR This episode we have: Bradley Schatz of Shatz Forensics and Evimetry, @blschatz, talking about his amazing new toolset Evimetry. Watch this first segment to learn more about AFF4, imaging bottlenecks and how his toolset can allow faster imaging locally, remotely and in cloud while doing a bunch of other really cool stuff! Learn more about his toolset here: http://evimetry.com/ Scott Wahlstrom of KPMG, @wahlstros, came on to talk about the deployable mobile forensic GoKits KPMG has been testing and using in the field. Cool stuff here if you ever wonder how you can bring an entire analysis lab to a data center for a week. Lastly Matt and I talk about whats new in Windows 10 Forensics with the following artifacts covered: Lnk Files Recent Docs Shell bags and Jumplists Watch a couple times to really understand the impact this will have on your investigations!
The Forensic Lunch! The videocast/livecast/podcast all about #DFIR!
This week we have Eric Zimmerman talking about the work he did speed and scale testing Encase, FTK and X-ways.
Also Matthew and I talking about our newest tool BitRocker which will expose which recovery keys will unlock a bitlocker encrypted volume. Get our newest tool BitRocker here: https://www.gettriforce.com/product/bitrocker-bitlocker-recovery-key-identifier/ Read Eric's testing here: https://binaryforay.blogspot.com/2016/09/let-benchmarks-hit-floor-autopsy-vs.html
The Forensic Lunch! The twice a month live videocast/podcast all about #DFIR! This broadcast is all about running an isolated virtual network on Intels newest NUC, the Skull Canyon. Watch the video to see us demonstrate running 5 vms in an isolated virtual network on a small, fast and low powered portable system. You can get the Intel NUC Skull Canyon at amazon here: https://smile.amazon.com/Intel-NUC-Ki... or at your local Microcenter or Fry's This is the M.2 NVME SSD Drive I'm using to get 2GB/s reads and 1.5GB/s writes: https://smile.amazon.com/Samsung-950-... This is the memory I used: https://smile.amazon.com/Crucial-16GB... Here is the link to the free version of ESXI v6: https://my.vmware.com/en/web/vmware/e... Expect a blog post where I go through the process
The Forensic Lunch! The twice a month live videocast/podcast all about #DFIR !\ This broadcast: Matt Bromiley, +Matt Bromiley talking about filters he has made for Elastic Handler and work Talking about the 1st Annual Defcon Forensic CTF Updates to EventMonkey to work with EVTXtract from Willi Ballenthin and bringing in descriptions and more! Download the Defcon Forensics CTF Here: https://forum.defcon.org/forum/defcon... The password to extract: ,sli38pdsf;aj8387f*HKlnelne7fy7GUHMBNWlo9udsijw_kn3ohfsa8y^%%T Submit your answers here: whymirosh@gmail.com Link to event monkey: https://github.com/devgc/EventMonkey