The Forensic Lunch with David Cowen and Matthew Seyer

Forensic Lunch 8-28-20 Sep 09, 2020

The Forensic Lunch! This week with Willi Ballenthin from the Mandiant FLARE Team talking about their tools

Forensic Lunch 8-14-20 Sep 09, 2020

The Forensic Lunch! This week with Sarah Edwards and Jared Barnhart talking about iphone testing labs, app testing and decoding apple photos machine learning identified photo metadata

Forensic Lunch 7-24-20 Sep 09, 2020

Forensic Lunch! This week with Jordan Barth talking about Azure and the Cloud!

Forensic Lunch 6-26-20 Sep 09, 2020

Forensic Lunch! This week it's time for the second Annual National Collegiate Cyber Defense Competition Redteam AMA!

Forensic Lunch 6-19-20 Sep 09, 2020

Forensic Lunch! This week with Google Incident Response Management Team! Learn how Google does IR Management and hear from Joachim Metz, James Nettesheim, Matt Linton and Alex Jager

Forensic Lunch 6-12-20 Sep 09, 2020

Forensic Lunch! This week with Eric Zimmerman showing SQLite Explorer and Javier Marcos discussing OSCtrl for OSQuery

Forensic Lunch 5-29-20 Sep 09, 2020

Forensic Lunch! This week with Yogesh Kahtri talking about MAC_APT, Brian Moran and Yuri Gubanov from Belkasoft

Forensic Lunch 5-22-20 Sep 09, 2020

Forensic Lunch! This week with Michael Cohen doing an hour and a half of Velociraptor!

Forensic Lunch 5-15-20 Sep 09, 2020

The Forensic Lunch! This week we are bringing Jad Saliba and Jessica Hyde from Magnet talking about the month of great content they've been hosting and the new things coming out of Magnet. In addition we will have the winner of the Magnet Virtual CTF 2020!

Forensic Lunch 5/8/20 - Jack Farley, Josh Brunty, Kevin Pagano, Tom Pace, Jim Arnold May 09, 2020

This week on the Forensic Lunch we had:

Josh Brunty, @joshbrunty, talking about his DFIR program at Marshall
- https://www.marshall.edu/cyber/
Tom Pace of Blackberry Cyclance and Jim Arnold of KPMG talking about recent ransomware trends.
Kevin Pagano, @kevpagano3, talking about his Sunday Funday and the Magnet Virtual CTF
Jack Farley, @jackfarley248, talking about MEAT and the Magnet Virtual CTF
- https://github.com/jfarley248/MEAT

You can watch it here:

https://youtu.be/fPzSm-hofA0

Forensic Lunch 5/1/20 - Oleg Skulkin (FeatureUsage), Brian Marks (Office 365) , Lee Whitfield 4CAST May 01, 2020

This week the Forensic Lunch went into Overtime! We went a full 25 minutes over the usual hour because we had so much to talk about. On this weeks show:

Matt Seyer (@forensic_matt) talked all about the etl parser and monitor he's working on in Rust! https://github.com/forensicmatt/RsWindowsThingies
Oleg Skulkin (@oskulkin) talked about how he approaches Sunday Funday's (he's won 3!) and about his new blog post about the Windows FeatureUsage artifact. https://www.group-ib.com/blog/featureusage
Brian Marks (@briandfir) talked about how the Office365 UAL MailboxItemsAccessed Audit event works and what the entry details mean
Lee Whitfield (@lee_whitfield ) talked through the Forensic 4Cast Awards nominations that end in two weeks, and Matt and I gave who we will be nominating. https://forensic4cast.com/2020/02/2020-forensic-4cast-awards-nominations-are-open/

Forensic Lunch 4/24/20 with the Google IR Team (GRR, Timesketch, Turbinia, DTTimewolf, More!) Apr 24, 2020

We had a jam packed Forensic Lunch today with a portion of the Google IR team today talking all about the open source tools they develop, use and support in their work at Google.

Specifically we had :

Mikhail Bushkov giving a big update on GRR https://github.com/google/grr
Johan Berggren (https://twitter.com/jberggren) and Kristinn Gudjonsson (https://twitter.com/el_killerdwarf) talking about Timesketch and Data science
- https://github.com/google/timesketch
Aaron Peterson (https://twitter.com/aarontpeterson) talking about Turbinia
- https://github.com/google/turbinia
Thomas Chopitea (https://twitter.com/tomchop_) talking about DTTimewolf
- https://github.com/log2timeline/dftimewolf
Theo Giovanna talking about libcloudforensics aka cloudforensicutils
- https://github.com/google/cloud-forensics-utils/tree/master/libcloudforensics
Joachin Metz (https://twitter.com/joachimmetz) - Talking about Plaso, libntfs and Libyal
- Plaso: https://github.com/log2timeline/plaso
- Libfsntfs: https://github.com/libyal/libfsntfs
- Libyal: https://github.com/libyal

Join them on the Open Source DFIR Slack: https://join-open-source-dfir-slack.herokuapp.com/

Read more about what they are doing on the Open Source DFIR Blog: https://osdfir.blogspot.com/

Forensic Lunch 4/17/20 with Zach Wasserman Apr 17, 2020

Today on the Forensic Lunch we only had one guest, Zach Wasserman, from OSQuery technical steering committee. We only had one guest because we knew we would have so much to talk to Zach about! From OSQuery's future in the linux foundation, Kollide Fleet and other fleet managers to Zach's work at Dactiv, LLC you have alot waiting for you in this weeks broadcast.

You can reach Zach Wasserman on twitter @TheZachW or Zach can be reached at zach@dactiv.llc if you want to work with him!

Forensic Lunch 4/10/20 with Belkasoft, AWS IR Automation, MVS DFIRFIT and HTTP Security Headers Apr 15, 2020

What a great Forensic Lunch today!

On today's broadcast we had:

Yuri Gubanov (@belkasoft) giving an update about whats going on at Belkasoft. Including their IOS 13.4 full file system acquisition using Checkm8, their new IR module in Belkasoft Evidence Center and a neat capability to do managed remote logical phone collections.

Steve Gibson and Spencer Hendee (@stevegibson) from KPMG (disclaimer I work there too!) came on to discuss the really cool AWS Cloud IR Automation we've been working on.

Brian Moran (@brimorlabs) social media maven and principal of BriMorLabs came on to discuss the Magnet Virtual Summit DFIRFIT 2020 where for a donation (and some excercise) you can get a cool prize pack shipped to you anywhere in the world! Register here: https://mvsdfirfit2020.com

Caleb Queern (@HttpSecHeaders) also of KPMG came on to discuss the clearsite HTTP header. This was interesting as its a directive a website can give to a browser to tell it to clear/not store history or data about it. This will need to be tested, you can read more here https://w3c.github.io/webappsec-clear-site-data/

So great stuff this week, you can watch below. Otherwise next week we've already confirmed Zach Wasserman to come and talk about OSQuery and Kollide!

Forensic Lunch 4/3/20 Apr 15, 2020

On this episode:

Mari Degrazia (@MariDegrazia) discussing her research into WinSCP and later movement, you can read more here: http://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html
Hal Pomeranz (@hal_pomeranz) talking about his new Linux Forensics course that you can download here: https://ia801406.us.archive.org/6/items/HalLinuxForensics/HalLinuxForens ics_archive.torrent
Alex Levinson (@alexlevinson) Gave an update on the National Collegiate Cyber Defense Competition which as gone all virtual this year
Matt Seyer (forensic_matt) talked about our upcoming SANS DFIR presentation and tools he's working on
Sarah Edwards (@iamevltwin) gave colorful commentary and meaningful insights

Forensic Lunch 12/13/19 - CTI Summit Apr 15, 2020

Live with Rick Holland, Ryan Johnson and Evan Dygert

Forensic Lunch 10/25/19 - Champlain DFA Defcon DFIR CTF - Martin Korman - Regipy Apr 15, 2020

The Forensic Lunch!

This week with the Champlain Digital Forensics Association talking about the Defcon DFIR CTF and Martin Korman talking about his project regipy

Forensic Lunch 7/19/19 with Alex Levinson Apr 15, 2020

This week with Alex Levinson from Uber

Forensic Lunch 5/3/19 CCDC AMA Live Apr 15, 2020

The Forensic Lunch!

Sli.do link https://app2.sli.do/event/hzkazryr/live/questions

This broadcast we are doing a live AMA from Reddit all about the NCCDC Redteam

Forensic Lunch 4/3/19 Live from MUS 2019 Apr 15, 2020

The Forensic Lunch!

Live from the Magnet User Summit 2019!

Forensic Lunch 3/20/20 - Lance Spitzner and Jessica Hyde Apr 15, 2020

with Lance Spitzner talking about Sans Live Online, Jessica Hyde talking about the Magnet Virtual Summit

Forensic Lunch 3/8/19 Eric Zimmerman, Lee Whitfield , Kape, Forensic 4Cast, Nominations Apr 15, 2020

The Forensic Lunch 3/8/19! The twice a month, usually, podcast/videocast that's all about DFIR This week we have: Eric Zimmerman, talking about KAPE Lee Whitfield, talking about the Forensic 4Cast award nominations

Forensic Lunch 2/21/20 - Anzac Edition Apr 15, 2020

Forensic Lunch ANZAC edition with Michael Cohen talking about Velociraptor

Shanna Daly talking about her work in Australia

Phil Moore, Nick Klein talking about their new entity and thisweekin4n6

Forensic Lunch 2/7/20 - Blackbag Update Apr 15, 2020

Forensic Lunch with Sarah Edwards, Ashley Hernandez , Dr Joe Sylve catching us up with the new combined Celebrite/Blackbag

Forensic Lunch 2/1/19 Blanche Lagny Amcache DFIR Review Apr 15, 2020

The Forensic Lunch 2/1/19! The twice a month, usually, podcast/videocast that's all about DFIR This week we have: Blanche Lagny talking about her paper on Amcache The DFIR Review crew talking about .. DFIR Review! crew entails: Jessica Hyde Vico Marziale Brett Shavers Tony Knutson

Forensic Lunch 1/24/20 - Ryan Benson, Jessica Hyde and Aaron Sparling Apr 15, 2020

Forensic Lunch! Live with Ryan Benson talking about Unfurl, Jessica Hyde and Aaron Sparling talking about Memory forensics

Forensic Lunch 1/10/20 with Lee Whitfield Apr 15, 2020

This week Lee Whitfield joins us to discuss the DFIR Summit and Matt showed us his rust based live windows monitors for DFIR Research

Forensic Lunch 6/15/18 Jun 15, 2018

The Forensic Lunch! Live this week with jaco_za who walked us through how he won the Magnet User Summit CTF we built.

Forensic Lunch 6/8/18 Jun 15, 2018

Live from the DFIR Summit in Austin, Texas.

This short episode we had Rob Lee talking about the new Windows Forensics Poster and Lee Whitfield talking about the Forensic 4cast awards.

Forensic Lunch 5/21/18 May 23, 2018

Live from the Magnet User Summit in Las Vegas with Jessica Hyde, Heather Mahalik, Jad Saliba, Matthew Seyer and David Cowen

Forensic Lunch 5/18/18 May 20, 2018

Live with Jason Jordaan talking about DFIR in South Africa, James Cooksey talking about Belkasoft, Troy Schnack talking about his work and being nominated for Forensicator of the Year, Matthew Seyer and David Cowen

Forensic Lunch 5/4/18 May 20, 2018

Live with Maxime Lamothe-Brassard, Nicole Ibrahim, Matthew Seyer and David Cowen talking about ETLs, the SANS DFIR Summit, and Lima Charlie

Forensic Lunch 4/20/18 May 20, 2018

Live with Lee Whitfield, Matthew Seyer and David Cowen talking about the Forensic 4Cast award Nominees

Forensic Lunch: 4/6/18 May 20, 2018

The Forensic Lunch live with Matthew Seyer and David Cowen talking about how Office saves files and more testing

Forensic Lunch 3/9/18 May 20, 2018

Live with Maxim Suhanov (@errno_fail), Matthew Seyer and David Cowen talking about Registry Forensics, Transactional Registry logs and his library YARP

Forensic Lunch 3/2/18 May 20, 2018

Live with Eric Zimmerman, Matthew Seyer and David Cowen talking about Registry Explorer and transactional registries

Forensic Lunch 2/23/18 May 20, 2018

Live with Phill Moore, Dr. Bradley Schatz, Matthew Seyer and David Cowen talking about This week in forensics and Evimetry

Forensic Lunch 2/16/18 May 20, 2018

Live with Ashley Hernandez, Joe Sylve, Matthew Seyer and David Cowen talking about Blacklight and Blackbag

Forensic Lunch 1/26/18 May 20, 2018

Forensic Lunch Live with Devon Ackerman, Matthew Seyer and David Cowen. Devon Ackerman presented on Office365 forensics

Forensic Lunch 1/19/18 May 20, 2018

Forensic Lunch Live with Lee Whitfield, Matthew Seyer and David Cowen

Forensic Lunch Test Kicthen 12/7/17 May 20, 2018

Forensic Lunch Test Kitchen live DFIR testing on 12/7/17

Forensic Lunch Test Kitchen 12/6/17 May 20, 2018

Forensic Lunch Test Kitchen live DFIR testing on 12/6/17

Forensic Lunch Test Kitchen 12/5/17 May 20, 2018

Forensic Lunch Test Kitchen live DFIR testing on 12/5/17

Forensic Lunch Test Kitchen 12/4/17 May 20, 2018

The Forensic Lunch Test Kitchen 12/4/17, live testing of forensic artifacts

Forensic Lunch 10/17/17 May 20, 2018

The Forensic Lunch live with Mark Mckinnon, Brian Moran, Brian Carrier and Jessica Hyde

Forensic Lunch 10/13/17 May 20, 2018

The Forensic Lunch live with Rebekah Brown

Forensic Lunch 8/18/17 May 20, 2018

The Forensic Lunch with Chuck Norris, correlation in Arrango DB and shellbags testing

Forensic Lunch 8/11/17 May 20, 2018

Forensic Lunch With Elizabeth Schweinsberg talking about DFRWS

Forensic Lunch 7/14/17 May 20, 2018

The Forensic Lunch with Mary Ellen Kennel and Devon Ackerman talking about the AbourDFIR project

Forensic Lunch 5/26/17 May 18, 2018

This week Jessica Hyde and Brian Moran joined us talking about their research into Amazon Alexa and Google Home.

Forensic Lunch 5/25/17 May 18, 2018

Live From Enfuse Day 3!

This week with Lesley Carhart, @hacks4pancakes talking about being the very first Women in Technology solving for X award presented by Guidance Software, hacks4kids and her dfir research interests

Dr. Bradley Shatz, @wirespeed4n6, talking about DFRWS evimetry, aff4 and his new advanced imager

Ashley Hernandez, @ashleyatencase, talking about all the new things coming from guidance regarding Encase Forensic, Endpoint investigator and mobile acquisition/examiner

Forensic Lunch 5/24/17 May 18, 2018

Steve Whalen from Sumuri, Jake Williams from Rendition Infosec and Dmitry Sumin from Passware

Forensic Lunch 5-23-17 May 17, 2018

Live with Amber Shroader of Paraben, Matt Bromiley from SANS, Matt Mcfadden Director of training from Opentext/Guidance

Forensic Lunch 5/19/17 May 19, 2017

The Forensic Lunch!

This week we had:

Cindy Murphy, @CindyMurph

Matt Linton, @0xMatt

Ryan Pittman no @ to be had

talking about how music and forensics goes together and the impact of listening to music on solving technical issues.

Also Matt and I talked about Enfuse as well as stupid shell item tricks.

Forensic Lunch 4/28/17 Apr 28, 2017

Paul Shomo comes on to talk about Guidance Software's new Forensic Artifact Research Program where you can get $5,000 USD just for research you are already doing! Find out more here: https://bugcrowd.com/guidancesoftware?preview=114da7695ff86ae70ec01aaf2c6878b0&utm_campaign=9617-Forensic_artifact-20170426&utm_medium=Email&utm_source=Eloqua

Phil Hagen introduced the new SANS Network Forensics poster to be released later this month

Matt Bromiley is talking about the Ken Johnson Scholarship setup by SANS and KPMG you can learn more and apply here https://digital-forensics.sans.org/blog/2017/03/03/ken-johnson-dfir-scholarship

Phil, Matt, Lee and I talked about the DFIR Summit

Lee Whitfield and I talked about the 4Cast Awards, Voting is open here: https://forensic4cast.com/forensic-4cast-awards/

Forensic Lunch 4-7-17 Apr 24, 2017

This week have:

Ashley Hernandez from Guidance Software talking about Enfuse

Nicole Ibrahim from G-C Partners talking about event tracing logs in Windows

Lee Whitfield summing up the news of the week

Forensic Lunch 3-24-17 Apr 06, 2017

This episode we catch up with Lee on the news and talk about current issues in DFIR.

Forensic Lunch 3/10/17 Apr 06, 2017

This episode we talk vault 7 leaks with Lee Whitfield, what it means for DFIR and other news as well as DFIR database usage discussions and development updates with Matthew and I.

Forensic Lunch 2-10-17 Feb 16, 2017

Michael Louis joins us to talk about how lawyers select and vet experts. Also talks about Toastmasters and how they teach good presentation skills and analogy creation through their program.

Matt Bromiley is here to announce BBQ Con!

Forensic Lunch 2-3-17 Feb 16, 2017

Ryan Benson is here to talk about updates to Hindsight, what he's been up to and his other tool SQUID.

David Dym came on to talk about FAT32 removable storage and the things OSX does to it.

Forensic Lunch 1-27-17 Feb 16, 2017

Lee Whitfield comes on to talk about the Forensic 4Cast awards which are now taking nominations.

Jonathan Poling came on to talk about his new blog and his work at Secureworks

Forensic Lunch 1-20-17 Feb 16, 2017

Friend of the show Eric Zimmerman is back to talk about updates to his tools and research

Forensic Lunch 12-30-16 Feb 16, 2017

Davida and I talk about whats new in our research, tools and packages

Forensic Lunch 11-4-16 Feb 16, 2017

Michael Gough talking with us about his tool LOG-MD and his work.

We also go into SRUM again showing new data we can correlate within it.

Forensic Lunch 10-28-16 Hibernation Recon Feb 16, 2017

This episodes is all about Hibernation files and Mark Spencer's company Arsenal Consulting research into it that led to the creation of a new tool called Hibernation Recon.

Forensic Lunch 10-26-16 Live from OSDFCon Feb 16, 2017

Live broadcast from OSDF Con 2016

Talking about DCITA, Autopsy and the academic program that Mark McKinnon is running at Davenport.

Sorry about the audio on this one, we had a bad upstream.

Forensic Lunch 9 23 16 Sep 23, 2016

The forensic lunch! The twice a month live videocast/podcast all about #DFIR This episode we have: Bradley Schatz of Shatz Forensics and Evimetry, @blschatz, talking about his amazing new toolset Evimetry. Watch this first segment to learn more about AFF4, imaging bottlenecks and how his toolset can allow faster imaging locally, remotely and in cloud while doing a bunch of other really cool stuff! Learn more about his toolset here: http://evimetry.com/ Scott Wahlstrom of KPMG, @wahlstros, came on to talk about the deployable mobile forensic GoKits KPMG has been testing and using in the field. Cool stuff here if you ever wonder how you can bring an entire analysis lab to a data center for a week. Lastly Matt and I talk about whats new in Windows 10 Forensics with the following artifacts covered: Lnk Files Recent Docs Shell bags and Jumplists Watch a couple times to really understand the impact this will have on your investigations!

Forensic Lunch 9-2-16 Sep 02, 2016

The Forensic Lunch! The videocast/livecast/podcast all about #DFIR!

This week we have Eric Zimmerman talking about the work he did speed and scale testing Encase, FTK and X-ways.

Also Matthew and I talking about our newest tool BitRocker which will expose which recovery keys will unlock a bitlocker encrypted volume. Get our newest tool BitRocker here: https://www.gettriforce.com/product/bitrocker-bitlocker-recovery-key-identifier/ Read Eric's testing here: https://binaryforay.blogspot.com/2016/09/let-benchmarks-hit-floor-autopsy-vs.html

Forensic Lunch 8-26-16 Sep 02, 2016

The Forensic Lunch! The twice a month live videocast/podcast all about #DFIR! This broadcast is all about running an isolated virtual network on Intels newest NUC, the Skull Canyon. Watch the video to see us demonstrate running 5 vms in an isolated virtual network on a small, fast and low powered portable system. You can get the Intel NUC Skull Canyon at amazon here: https://smile.amazon.com/Intel-NUC-Ki... or at your local Microcenter or Fry's This is the M.2 NVME SSD Drive I'm using to get 2GB/s reads and 1.5GB/s writes: https://smile.amazon.com/Samsung-950-... This is the memory I used: https://smile.amazon.com/Crucial-16GB... Here is the link to the free version of ESXI v6: https://my.vmware.com/en/web/vmware/e... Expect a blog post where I go through the process

Forensic20Lunch208-12-16 Aug 16, 2016

The Forensic Lunch! The twice a month live videocast/podcast all about #DFIR !\ This broadcast: Matt Bromiley, +Matt Bromiley talking about filters he has made for Elastic Handler and work Talking about the 1st Annual Defcon Forensic CTF Updates to EventMonkey to work with EVTXtract from Willi Ballenthin and bringing in descriptions and more! Download the Defcon Forensics CTF Here: https://forum.defcon.org/forum/defcon... The password to extract: ,sli38pdsf;aj8387f*HKlnelne7fy7GUHMBNWlo9udsijw_kn3ohfsa8y^%%T Submit your answers here: whymirosh@gmail.com Link to event monkey: https://github.com/devgc/EventMonkey

Forensic Lunch 7/29/16 Jul 29, 2016

It's the Forensic Lunch! The twice a month live videocast/podcast all about DFIR This episode's guests: Phil Hagen Eric Zimmerman Links: - Twitter: @SOF_ELK - Config/code repo: http://for572.com/sof-elk-git - VM readme (w/ instructions and download link):

Forensic Lunch 7/15/16 Jul 15, 2016

It's the Forensic Lunch! The twice monthly videocast/podcast just about #DFIR join us as we talk about whats new and what new things you can do! This broadcast we are taking the time to update you on our own tools. We talked about: Pancake Viewer, an open source tool to visually explore forensic images and shadow copies (like an open source ftk imager), https://github.com/forensicmatt/PancakeViewer Event Monkey, an open source and multi threaded event log parser that outputs to sqlite and ElasticSearch, https://github.com/devgc/EventMonkey Event Monkey Monitor, a tool we are working on releasing that lets you monitor event logs in real time pytskUSBDeviceForensics, a version of WoanWare's USB Device Forensics program that allows you to feed in images, https://github.com/woanware/usbdeviceforensics/blob/master/pyTskusbdeviceforensics.py

Forensic Lunch live from Enfuse Day 2 Jul 13, 2016

This episode is live from Enfuse with

Jake Williams and Heather Mahalik

Paul Shomo of Guidance Software

Ashley Hernandez of Guidance Software

Jeff Hedlesky of Guidance Software

Forensic Lunch live from Enfuse Day 1 Jul 13, 2016

Forensic Lunch live from EnFuse with Rob Batzloff talking about Encase 8, and James Wiebe talking about new advancements at CRU

Forensic Lunch 4/29/16 Ladies Edition Apr 29, 2016

The Forensic Lunch! A special episode hosted by Nicole Ibrahim and featuring in no particular order: Mari Degrazia Cindy Murphy Heather Mahalik Sarah Edwards Shelly Giesbrecht

Forensic Lunch 4/8/16 with Jared Atkinson Apr 08, 2016

The forensic lunch!The one hour, mostly, DFIR videocast/podcastThis weeks guest:Jared Atkinson,@jaredcatkinson, talking about about DFIR in powershell or as he calls his toolset PowerForensicsWhat a great Forensic Lunch today with Jared Atkinson talking all about how to do forensics on a live system or mounted image with his Powershell framework PowerForensics.You can grab your own copy of PowerForensics on Github here:https://github.com/Invoke-IR/PowerForensicsRead his Blog here:www.invoke-ir.comVote for him in the Forensic4Cast Awards here:https://forensic4cast.com/forensic-4cast-awards/Reminder I'm up for voting in another category as well!and of course you can follow him on Twitter here:https://twitter.com/jaredcatkinsonBtw, if you want to learn Windows Forensic with me I'm schedule to teach SANS FOR408 Windows Forensics in Houston May 9-14. You can find out more here:https://www.sans.org/event/houston-2016/course/windows-forensic-analysis

Forensic Lunch 3/25/16 Mar 28, 2016

The Forensic Lunch!The one hour, mostly, videocast/podcast all about DFIR.This weeks guests:Maxime Lamothe-Brassard of Refraction Point talking about his project Lima Charlie https://github.com/refractionPOINT/li...Ryan Nolette, Security Operations Lead at Carbon Black, talking about all of the ransomware variants he's been seeing and how shadow copies are affectedUs talking about how different tools deal with shadow copies and accessing deleted shadow copies

Forensic Lunch 3/11/16 Mar 17, 2016

It's the forensic lunch!

This broadcast James and I go through the results of our testing of different file carving tools:

X-Ways Forensics

Bulk Extractor

Blade

Blackbag Blacklight

Forensic Lunch 2/26/16 with BlackBag Tech Feb 27, 2016

It's the Forensic Lunch! The one hour, mostly, videocast/podcast all about DFIR! This weeks guests:Austin Colby, Joe Sylve and Vico Marziale from Black Bag talking about the newest additions to the new version coming out in a matter of days.

Forensic Lunch 1/22/16 Jan 22, 2016

The Forensic Lunch!The 1 hour, usually, videocast/podcast that brings you the latest in new DFIR research, topics and people. This weeks guests:Hal Pomeranz,@hal_pomeranz, of Deer Run associates talking about updates to his Linux Memory Grabber and some research into bash_history behavior.You can get the linux memory grabber he discussed here https://github.com/halpomeranz/lmgHal can be reached at hal@deer-run.comEric Zimmerman,@EricRZimmerman, of Kroll's cyber security practice talking about prefetch and explaining his tool to get more, as well as whats new in Windows 10 prefetchYou can get Eric's prefetch parser here: https://github.com/EricZimmerman/Prefetchhttp://www.kroll.com/en-us/who-we-are/kroll-experts/eric-zimmermanMatthew and I showing how to use the hfs+ journal parser and what to do with itYou can get the HFS+ Journal parser here: https://www.gettriforce.com/product/hfs-journal-parser/

Forenisc Lunch 1-8-16 Jan 08, 2016

The first new lunch of the new year withSarah Holmes of the Foreman project (Open Source DFIR Matter Management), You can get a copy (and contribute to!) foreman here:https://bitbucket.org/lowmanio/foreman/You can contact Sarah here: sarah@lowmanio.co.ukMichael Robinson of the Black T-Shirt Cyber Forensics Challenge talking about well the Black T-Shirt Cyber Forensics ChallengeYou can join the Black T-Shirt Cyber Forensics Challenge here:http://cyberforensicschallenge.com/You can contact them at cyberforensicschallenge@gmail.comOur FSEvents tool will be released just as soon as we write documentation for it. Want an early release for testing? Email me dcowen@g-cpartners.com

Forensic Lunch 11/20/15 Live from Google! Nov 23, 2015

Forensic Lunch!

This episode we are live from Google in Mountain View, California getting an update on their development projects.

Included are:

LibYAL

Forensic Artifact project

GRR (Google Rapid Response)

Rekall memory analysis platform

Plaso

Timesketch and more!

Forensic Lunch 11/13/15 Nov 23, 2015

Forensic Lunch!This weeks guests:Andrew Case,@attrc, from the Volatility Project talking about Volatility 2.5, new plugins and the winners of this years Volatility Plugin ContestYogesh Kahtri, from Champlain, talking about SRUM forensics in Windows 8.1+. A truly amazing new artifact Matt and I talking about our new open source tool Elastic Handler

Forensic Lunch 10/28/15 - Live from OSDFCon Nov 02, 2015

The Forensic Lunch!

In this episode we are broadcasting live from OSDFCon with the following content:

1. A revised set of rules from our popular forensic game. This time we follow $10,000 pyramid rules to see which of two forensic teams can win!

2. Brian Carrier from Basis Technology talking about whats new Autopsy 4.0

3. Rob Fry from Netflix talking about their new open source framework called Fido and hanging with Kevin Spacey

4. Matthew and I talking about our new automation, normalization and correlation framework ElasticHandler

Forensic Lunch 10/9/15 with Dave Hawkins, Chris Pavan and James Habben Oct 15, 2015

This week on the forensic lunch we have:

Dave Hawkins talking about his firms currently unbeaten contest, lampbash.work

Chris Pavan, talking about his computer forensics program at Cal State Fullerton and his work in IR at Bechtel

James Habben talking about his web based front end to volatility called eVOLVe and all the cool things you can do with it

Forensic Lunch 9/25/15 with Mari Degrazia, Lee Whitfield and Suzanne Widdup Oct 15, 2015

This broadcast we have:

Mari Degrazia talking about testing MFT parsers and what goes into them.

Lee Whitfield talking about the events of the week

Suzanne Widdup talking about her work on the Verizon DBIR and a solicitation for your involvement

A talk about Cortana's location tracking storage

Forensic Lunch 5-19-15 Live from CEIC Day 1 Sep 14, 2015

Live from CEIC with Michael Robinson, Ronald Clark and more!

Forensic Lunch 8-21-15 Sep 14, 2015

In this episode:We discuss the Ashley Madison Data Leak and it's implications for DFIRDavid Dym, @dave873, talks about the newest version of Metadiver and it's ability to show even more metadata, including the contents of pst files and extended mapi!Get it at: www.easymetadata.comMatthew and I talk about our new open source project GC LNK Parser which exposes all of the shell item data we didn't know was there! (Except Joachim Metz) We also preview our integration of our tools to Elastic Search, a preview of our OSDF Con talk and a short talk about things to come in Triforce. Also SANS FOR578, Cyber Threat Intelligence, is now available publicly! Learn more about it here:https://www.sans.org/course/cyber-thr...The SANS Poster on Rekall Memory forensics is out as well and you can get it here: https://www.sans.org/security-resourc...

Forensic Lunch 7-8-15 live from SANS DFIR Sep 14, 2015

In this episode recorded in front of a live audience:Our first game of Forensic PassphraseVitaliy Mokosiy of Atola talking about Atola Insight Forensic and its cool direct firmware controlsBrain Carrier of Basis Technology talking about Autopsy 3, Plugin development with Python and OSDF ConBrian Moran of BriMor Labs talking about his live response scripts and new trends in attacker activities

Forensic Lunch 7-3-15 Sep 14, 2015

Freedom Edition!Join Matt and I and current guests:Eric Zimmerman, talking deleted registry key analysis and new features in Registry Explorer and more!

You can get the #DFIRSummit release here: https://www.dropbox.com/s/s7doopqpwxz...

Forensic Lunch 6-12-15 Sep 14, 2015

Guests are Matt Bromiley

Dimitry from Bocasoft

Forensic Lunch 5-20-15 CEIC Day 2 Sep 14, 2015

Live from CEIC. Ben LeMere from Berla, Jeff the Product Evanglist from Guidance Software, Amber Shroader from Paraben, and more!

Forensic Lunch 4-22-15 Sep 14, 2015

The you should have filed your taxes edition!This week is all about the Forensic 4cast awards. We cover all of the nominees and make our official votes.

Forensic Lunch 4-3-15 Sep 14, 2015

The thank goodness April Fools day is over editionGuests this week:Devon Kerr talking about his work at Mandiant/Fireeye and his research into WMI for both IR and attacker usage.You can email Devon here: devon.kerr@mandiant.comand you can follow him on twitter here: https://twitter.com/_devonkerr_Get cool tools from the Mandiant github here: https://github.com/mandiantWatch Devon talk more about WMI and IR at the SANS DFIR Summit: http://dfir.to/1BvOw7G Matthew and I going into the Automating DFIR series and our upcoming talk at CEICWe are on the CEIC agenda here:https://www.guidancesoftware.com/ceic...

Forensic Lunch 3-20-15 Sep 14, 2015

We had another great Forensic Lunch! This broadcast we had:James Carder of the Mayo Clinic, @carderjames, talking all about automating your response process to separate the random attacks from sophisticated attacks. You can hear James talk about this and much more at the SANS DFIR Summit where he'll be a panelist! If you want to work with James Mayo Clinic is hiring.Mayo Clinic Infosec and IR Jobs: http://www.mayo-clinic-jobs.com/go/in...Contact James Carder: carder.james@mayo.eduSpecial Agent Eric Zimmerman of the FBI, @EricRZimmerman , talking about his upcoming in depth Shellbags talk at the SANS DFIR Summit as well as his new tool called Registry Explorer. RE and Eric's research into windows registries will be continued in the next broadcast. Whether you are interested in registries from a research, academic or investigative perspective this is a must see, and FREE, tool!Eric's Blog: http://binaryforay.blogspot.com/Eric's Github:https://github.com/EricZimmermanRegistry Explorer: http://binaryforay.blogspot.com/p/sof...

Forensic Lunch 2-27-15 Sep 14, 2015

Guests this broadcast:Ben LeMere of Berla talking about Vehicle Forensics, Embedded Systems, Cam bus networks and all the fun he's been having with doing forensics on car entertainment systems. You may be very surprised but what he has to say!Lee Whitfield talking about Superfish, what happened and what you need to know. Robin Keir of Crowdstrike talking about his research and role at Crowdstrike, specifically Superfetch and CrowdResponseShow linksBen LeMereWebsite: http://Berla.coTwitter: @BenLeMereLee WhitfieldForensic 4cast Award Nominations:https://forensic4cast.com/forensic-4c...Twitter: @lee_whitfieldRobin KeirWebsite: http://www.crowdstrike.com/Crowd Response:http://www.crowdstrike.com/community-...Twitter: @RobinKeir

Forensic Lunch 11-28-14 Sep 14, 2015

The after Thanksgiving Hangover edition:

This week we had Eric Zimmerman, @ericrzimmerman, talking about Shellbags, his tool Shellbag explorer and our research into new things we can determine from them.

Forensic Lunch 2-21-14 Sep 14, 2015

We had an interesting Forensic Lunch today with:Rob Fuller, @mubix, talking about his new project, project mentor http://www.projectmentor.net/ where Rob is offering to help mentor you into developing the real technical skills in infosec and dfir to get into the industry and other noble aspirations.David Dym, @dave873, talking about the latest version of Metadiver which is available to download at http://www.easymetadata.com/wp/ which can crawl a directory and pull out all the metadata it can find into xls, json, xml and other formats. He also makes shadowkit.Kevin Stokes talking about how to extend and expand our USB Multiboot Dongle, you can download the dongle image here: https://mega.co.nz/#!i45WhQya!SQILk0T...Zoltan Szabo, talking about his stance on Digital Forensics as a science.You can email him at zoltandfw@gmail.com if you want to give your feedback to his opinions.

Forensic Lunch 12-13-13 Sep 14, 2015

This week with:Yogesh Kahtri talking about his Windows 8 registry forensics research (You can read it here http://www.swiftforensics.com/ and email him yogesh@swiftforensics.com)

Dan Pullega talking about his extensive research into Windows Shellbags (http://www.4n6k.com/2013/12/shellbags... and email Dan at dan.pullega@gmail.com)

David Dym talking about his new tool MetaDiver (You can download it here http://www.easymetadata.com/wp/)

and Matthew and myself talking about v3 of ANJP and demoing the auto detection of CD Burning.

Forensic Lunch 12-6-13 Sep 14, 2015

Robert Haist, talking about his research with page_brute in recovering command execution and other fun things from the pagefile, read his blog about it here: http://blog.roberthaist.com/2013/12/r...Amber Shroader, talking about Device Seizure 6.5 and a great discussion on what happens behind the scenes in your mobile forensics tools as well as the future of cloud phone data acquisition. You can find out more about Device Seizure here: http://www.paraben.com/device-seizure...

Joakim Schicht, discussing his tools and research, including how he approaches these projects and develops them. You can find his google code repository here: http://code.google.com/p/mft2csv/ with all the tools mentioned today and more!

Forensic Lunch 9/4/15 Sep 04, 2015

The Forensic Lunch!This week we have the Chief Evangelist of Accessdata Tim Leehealey, here to talk to us about FTK 6, whats going on at accessdata and your questions.

Forensic Lunch 2-13-15 Aug 25, 2015

Anuj Soni, discussing webshells and attacker toolsJason Trost, discussing the Modern Honey Net project he's working on at ThreatstreamMatt Bromiley talking about the work we are done to extend the MHN reporting by integrating elastic search and Kibana to visualize the dataShow notes:Anuj Soni:Twitter: @asoni• My SANS Webcast on web shells: https://www.sans.org/webcasts/closing...• The upcoming FOR610 course in Monterey: http://www.sans.org/event/dfir2015/co...• My bio and instructor page: http://www.sans.org/instructors/anuj-...- Webacoo https://github.com/anestisb/WeBaCooJason Trost:Twitter: @jason_trostThreatstream Github: https://github.com/threatstreamJason's Github: https://github.com/jt6211Modern Honey Network:http://threatstream.github.io/mhn/Threatsream: http://threatstream.com/Matt Bromiley:Twitter: @505forensicsBlog: http://www.505forensics.com/MHN Visualization Series: http://www.505forensics.com/honeypot-...http://www.505forensics.com/honeypot-...http://www.505forensics.com/honeypot-...Lee Whitfield:Twitter: @lee_whitfieldForensic 4cast awards nomination:https://forensic4cast.com/forensic-4c...Facebook Threatexchange: https://threatexchange.fb.com/

Forensic Lunch 1-30-15 Aug 25, 2015

This weeks guests:Kyle Maxwell - Threat Intel and HoneypotsLenny Zeltser - Malware Reversing, attacker tools and capturing malwareTo join the community MHN project discussion on this show email us at forensichoney@gmail.com

Forensic Lunch 1-9-15 Aug 25, 2015

The first forensic lunch of the new year!We had an open chat with a discussion of honeypots with Ken Pryor

Forensic Lunch 12-12-14 Aug 25, 2015

More about Shellbag research with Eric Zimmerman and other topics!

Forensic Lunch 10-3-14 Aug 25, 2015

This week we had:Matt Bromiley, @505forensics, talking about NoSQL injection attacks and forensics to detect them. You can read more about it on his blog http://www.505forensics.com/Matt Harrigan, @mattharrigan, of PacketSled, @packetsled, talking about his network visualization tool that is soon to have a free version released. You can sign up for the beta and get this into your hands at http://www.packetsled.com

Forensic Lunch 9-19-14 Aug 25, 2015

This time we have the winner of our current SANS DFIR Super Sunday Funday Forensic Contest! We will walk through all the levels revealing how they were done and how they were solved.

Forensic Lunch 8-26-14 Live from HTCIA Aug 25, 2015

We are broadcasting live from HTCIA International Conference with:Sumuri CarbonAndres Velazquez talking about Forensic in Latin AmericaMembership director for HTCIA talking about the organizationLatest updates on the Triforce from Matthew and I!

Forensic Lunch 8-15-14 Aug 25, 2015

Andrew Case talks about the release of his new book and discusses his research on memory forensics

Lee Whitfield talks about Facebook Messenger and other recent events.

Forensic Lunch 6-20-14 Aug 25, 2015

Forensic Lunch this week with:Blazer Catzen, talking about File system tunneling and metadata misadventuresCindy Murphy, talking about smart phone forensics and being Cindy Murphy

Forensic Lunch 6-13-14 Aug 25, 2015

The SANS DFIR Summit, our favorite talks and what makes it stand out as a conferenceDave Hull's, @davehull project Kansa http://github.com/davehull/kansaAn in depth discussion of Volume Shadow Copies discssuing: How to identify how much shadow copies are active on a volume (without VSS Admin) Evidence of Automatic vs Manual VSC deletion What different tools show for how many VSCs exist What you can and can't implictily trust How to validate what you seeMore about what forensic tools should provide to an examiner at a minimumAnd BBQ Summit talk!As discussed the show may change after next week and the weekly shows are no longer required to meet my year of blogging. I'd like to hear your thoughts of what would make show more valuable to. Topics I'd like to hear from you on include but are not limited to:Frequency, should we keep it once a week or go to twice a month / once amonthTopics, Are we covering what is important to you? Should we add anything else?Format, Do you enjoy the guests or us talking more?Time of day/Day of week, Is there a better time we could be doing this so more of you can watch it liveLet me know in the comments below or email me dcowen@g-cpartners.com, we do the show for you not us!

Forensic Lunch 6-6-14 Aug 25, 2015

We had a great Forensic Lunch today. We didn't have any official guests this week , just Matthew, You and I talking about what was interesting to us this week. We talked about:1. The SANS DFIR Summit2. The For 408 class I am currently assisting with3. The research into USB Device history that is leading to a race for application development between Eric Zimmerman and myselfHere are the links to he USB device lookups I found:Official list of Vendors from USB.org (requires you to convert from decimal to hex to match in the registry) http://www.usb.org/developers/tools/c...The Linux USB driver list of known USB Vendors and Products:http://www.linux-usb.org/usb.ids4. A good discussion about programming in DFIR and the movement towards common output formats and moving data between tools.

Forensic Lunch 5-30-14 Aug 25, 2015

Sarah Edwards, @iamevltwin, talking about her presentation on Mac/OSX malware.Lee Whitefield, @lee_whitfield, talking about the current Trucrypt conspiracy theories and what may have happenedFor those listening here are our conference recommendations:Large conference: CEICMid size but vendor sponsored: PFICMid size but independent : HTCIASmall and very technical: SANS DFIR Summit and OSDFCon

Forensics Lunch 5-21-14 Live from CEIC 2014 Day 2 Aug 25, 2015

Today we had: Austin Colby from Black Bag talking about whats new with Blacklight, Macqusition and much more. You can find out more at https://www.blackbagtech.com Steve Whalen, @sumurillc, talking about whats new at Sumuri including Paladin, Recon and others. Steve also talked about his new project Mission: No More Victims https://www.indiegogo.com/projects/mi... Sheryl Falk, @sherylfalk, talking about her talk at CEIC all about Data Breaches Matthew and I talking all about the official release of the Triforce! You can go here and find out all about it and buy your own license at http://www.gettriforce.com

Forensic Lunch 5-20-14 CEIC 2014 Day 1 Wrapup Aug 25, 2015

Live from CEIC talking about the best talks of the day and special guests!

Forensics Lunch 5-20-14 Live at CEIC 2014 Day 1 Interviews Aug 25, 2015

Suzanne Widup, @suzannewidup, talking about her talk at CEIC on the DBIR and her new book Ken Mizota, @kenm_encase, the product manager for Encase investigation products talking about whats new v7 and the upcoming v8 David Dym, @dave873, talking about his talk on SQLite forensics

Forensic Lunch 5-15-14 Aug 25, 2015

Live from ADUC join us as we talk about what's going on here and what new information is being revealed

Forensic Lunch 5-9-14 Aug 25, 2015

Mari DeGrazia, @maridegrazia, talking about her research into the Thunderbird email client, its variations and the tool she has put out to work with it. You can read her post about this on her blog as well as grab the tool here: http://az4n6.blogspot.com/2014/04/wha...Hal Pomeranz, @halpomeranz, talking about his research into Encrypted iTunes backups. How to extract out whats contained within them and when they were made, very cool stuff. Here are the links Hal mentioned:Stack overflow discussion of the manifest.mbdb file:http://stackoverflow.com/questions/30...Link to download Hal's tool here:https://github.com/halpomeranz/mbdblsLucas Zaichkowsky, @LucasErratus, from AccessData talking about his work there and a new reveal of their unified cybersecurity/response/forensics platform. Very cool stuff that I didn't realize they were already viewing. I'll have to get a better understanding of this technology!

Forensic Lunch 5-2-14 Aug 25, 2015

We had a very interesting forensic lunch today. Lee Whitfield, @lee_whitfield and Suzanne Widdup, SuzanneWidup, joined us and your comments in an open discussion. We discussed an article linked by Brian Moran located here: http://eandt.theiet.org/news/2014/apr... all about how some malware researchers are accessing bad guy forums using Heartbleed.We also got linked to a great case brief by Jason Alvarado, US v Jarrett, you can read here: http://lawschoolcasebriefs.com/LawSch... that is all about an anonymous vigilante in Turkey who provided evidence to the FBI about a pedophile. Who in the end got the evidence thrown out of court as the vigilante was not a government agent and the evidence was inadmissible.All in all a very interesting 45 minutes of discussion, we also talked about my beard, and I hope you agree this experiment was semi-successful. I plan to try this again and hopefully more of you will participate!

Forensic Lunch 4-25-14 Aug 25, 2015

Shelly Giesbrecht, @nerdiosity, talking about her upcoming talk at the SANS DFIR Summit called '10 Ways To Make Your SOC More Awesome', learn more about the event here and you can hear a leadup to it on a SANS Webinar here: https://www.sans.org/webcasts/10-ways...We also talked a bit about the National Collegiate Cyber Defense Competition where I am currently leading the red team before I had to run back to the fun! Also no audio issues!

Forensic Lunch 4-18-14 Aug 25, 2015

Santiago Ayala, @darthsaac, talking about his career in DFIR leading up to his nomination for a Forensic 4cast award nomination as Digital Forensic Examiner of the year! Listen to what Santiago has to say to see if you want to vote for him!Lee Reiber, @celldet, talking about a couple things:His upcoming trainings at the AccessData Users Conference on MPE+ , mobile forensics and python scripting with MPE+: https://www.ad-users.com/His upcoming talk at the SANS DFIR Summit called Peeling the Application Like an Onion which focuses on analysis of mobile applications, check out more hereand a good discussion on mobile forensics in its current state and where things are headed.Chris Pogue, @cpbeefcake, talking about a couple things:His upcoming talk at the SANS DFIR Summit called The Life Cycle of Cybercrime which focuses on the complete life of a case from where it starts to how law enforcement gets involved locally and globally, check out more hereAll about Sniper forensics, his team at Trustwave and the difficulties of doing DFIR around the world.

Forensic Lunch 4-11-14 Aug 25, 2015

Anthony Di Bello from Guidance Software talking about CEIC. CEIC is our industries biggest conference and we will be there. If you are interested go here http://www.guidancesoftware.com/ceic/... and follow them on twitter @encaseDavid Dym talking about his upcoming talk on SQLite forensics at CEIC and the early release of a new tool called SQLiteDiver which comes in GUI and CLI forms. You can download SQLiteDiver here: http://www.easymetadata.com/Downloads... and you can see Dave talk about it and SQLite forensics at CEIC!

Forensic Lunch 4-4-14 Aug 25, 2015

Dave Hull from Microsoft, you can follow Dave on Twitter @davehull , his blog http://trustedsignal.blogspot.com/ and on github https://github.com/davehull. You should come to the SANS DFIR Summit and see him there as well!Vico Marizale and Joe Sylve from 504ensics came back for their 3rd week of commitment! @vicomarziale and @jsylve. You should get involved with their new registry timestamp project by emailing them info@504labs.com to get their tool and start helping to discover unknown registry timestamps!

Forensic Lunch 3-28-14 Aug 25, 2015

Vico Marziale from 504ensics, discussing their memory differencing project amongst other topicsLee Whitfield discussing the upcoming deadline for Forensic 4cast award nominations and the trouble with time machines

Forensic Lunch 3-21-14 Aug 25, 2015

Vico Marziale, @vicomarziale Talking about the research being done at 504ENSICS Labs and specifically into the OSX Spotlight index.You can get a copy of spotlight inspector here:http://www.504ensics.com/tools/spotlight-inspector-digital-forensics-app-for-mac-osx/You can read the 504ensiecs blog herehttp://www.504ensics.com/blog/You can see the rest of their website and tools here:http://www.504ensics.com/Nasa Quba & Kausar Khizra - Talking about their research on Windows 8 File History!You can see Nasa & Khizra at the SANS DFIR Summit this june go into depth into this research during an hour presentation on the topic!Go here to learn more: https://bitly.com/David-Summit14To contact Nasa & Khizra their linkedin page is here:http://www.linkedin.com/in/kausarkhizra/http://www.linkedin.com/pub/nasa-quba...

Forensic Lunch 3-14-14 Aug 25, 2015

We had another great Forensic Lunch today, I hope you will consider making time in your Friday to watch it live someday as I think its just way more fun live. This week we had in order of appearance:Jake Williams, @malwarejake, talking about the results of the SANS Endpoint Security survey and the positions they are looking to hire at the Mayo Clinic for those of you looking for senior DFIR positions!You can also train with jake next month in Orlando and elsewhere, go here to see the classes he's teaching https://www.sans.org/instructors/jake....SANS/Guidance Endpoint Security Survey Webcast - http://bit.ly/1hYUYMUAlissa's Memory Forensics Class - Orlando, http://bit.ly/1e0ZEkDJake's Log Management and Forensics Class - Orlando, http://bit.ly/PBqkQyJake and Alissa's Memory Forensics vLive class - http://bit.ly/1imyw0VBrian Baskin, @bbaskin, talking about his research, blog (ghetto forensics), books (here is an amazon link), and his work at DC3 where they are looking for people interested in DFIR with a clearance who live in the Baltimore area! Reach out to him if you are interested.Vladimir Katalov, @vkatalov, the CEO of Elcomsoft talking about upcoming research regarding iCloud key chain recovery from network traffic, Blackberry 10 backups, accessing cloud storage and which gpus work well for long term password cracking. You can go to elcomsoft's website here and these are my favorite tools they sell:Elcomsoft Phone Password Breaker http://www.elcomsoft.com/eppb.html, great for cracking encrypted phone backups and accessing iCloud backups!Elcomsoft iOS Toolkit, http://www.elcomsoft.com/eift.html, great for low level working in iOS forensics.Elcomsoft password cracking bundle, http://www.elcomsoft.com/eprb.html, a nice collection of there password cracking tools

Forensic Lunch 3-7-14 Aug 25, 2015

This week withDoug Collins, talking about his career in DFIR and how to become a regular Sunday Funday winnerMark Spencer. @arsenalrecon, talking about his work at Arsenal Experts and their tools (Registry Recon and Arsenal Image Mounter)Sebastian Nerz, @tirsales, discussing the state of DFIR in Germany/EU

Forensic Lunch 2-28-14 Aug 25, 2015

Today's Forensic Lunch was great and really focused on IR and static malware analysis. If you are interested in either of those topics, boy do we have a great show for you. This week we had:Jack Crook, @jackcr, talking about his work in IR, how he got started, his forensic challenges and his work in building local DFIR community. You can read his blog here, http://blog.handlerdiaries.com/, and learn more about his community efforts in Virginia.Marc Ochsenmeier, @ochsenmeier, giving us the history of his tool PeStudio and an overview of how it works as well as the future of the tool. His website is http://winitor.com/ where you can download PeStudio for yourself as its free for non-commercial use!

Forensic Lunch 2-14-14 Aug 25, 2015

Rob Fuller, @mubix, talking about his new project, project mentor http://www.projectmentor.net/ where Rob is offering to help mentor you into developing the real technical skills in infosec and dfir to get into the industry and other noble aspirations.David Dym, @dave873, talking about the latest version of Metadiver which is available to download at http://www.easymetadata.com/wp/ which can crawl a directory and pull out all the metadata it can find into xls, json, xml and other formats. He also makes shadowkit.Kevin Stokes talking about how to extend and expand our USB Multiboot Dongle, you can download the dongle image here: https://mega.co.nz/#!i45WhQya!SQILk0T...Zoltan Szabo, talking about his stance on Digital Forensics as a science.You can email him at zoltandfw@gmail.com if you want to give your feedback to his opinions.

Forensic Lunch 2-7-14 Aug 25, 2015

We have an amazing Forensic Lunch this week!Robert Wallace & Matt Bromiley from talking about how they are using elastic search to work with big data breachesWilli Ballenthin,+Willi Ballenthin talking about his work in DFIR and he's recently released tools working with NTFS. You can read Willi's blog here: http://www.williballenthin.com/ and follow him on twitter @williballenthinBrian Moran,+Brian Moran talking about his work in memory forensics, POS Malware and other fun topics. You can read Brian Moran's blog here: and follow him on twitter @brianjmoran

Forensic Lunch 1-31-14 Aug 25, 2015

We had a very interesting Forensic Lunch this week! This weeks guests:Ian Duffy, +Ian Duffy , talking about his research into the Microsoft Office compound file format.You can read Ian's blogs on this topic here: http://forensecurity.blogspot.com/201...Andrew Case, +Andrew Case , discussing his work in the memory forensics and Volatility The Volatility project page is here: http://code.google.com/p/volatility/ You can pre-order the memory forensics book here: http://www.amazon.com/gp/product/1118... You can find out more about Volatility training here: http://volatility-labs.blogspot.com/2... Volatility Community Documentation can be found here: http://code.google.com/p/volatility/w... You can find out more about Bsides NOLA here: http://www.securitybsides.com/w/page/...Read the blog analyzing ADD that Andrew talked about here: http://blog.handlerdiaries.com/?p=363Matthew and I showing the latest changes for this months Beta release of ANJP.

Forensic Lunch 1-24-14 Aug 25, 2015

This weeks guests are:Jacob Williams, @malwarejake, talking about his proof of concept code shown at shmoocon check it out here: http://malwarejake.blogspot.com/2014/... and download the tool/memory samples here http://code.google.com/p/attention-de...Hal Pomeranz, @hal_pomeranz, talking about the scripts he's been sharing via GitHub for the DFIR Community: https://github.com/halpomeranz/dfisLee Whitfield, @lee_whitfield, talking about his new series of internet safety videos that you can show to your friends and family, found here: https://www.youtube.com/user/mrleewhi...

Forensic Lunch 1-17-14 Aug 25, 2015

Sarah Edwards talking about her OSX Forensics class for SANS, signup for the beta here:http://computer-forensics.sans.org/bl...Craig Ball talking about his work as a Special Master within the Civil Courts and his perspectives on DFIR, you can read more from Craig at his website: http://craigball.com/Matthew and I talking about the v3 Beta, the NCCDC Red Team intern position opening for CCDC alumni and more.

Forensic Lunch 1-3-14 Aug 25, 2015

Sean Conover from Sony Online Entertainment talking about his work doing memory analysis and forensics to stop game cheats. Follow him at https://twitter.com/seanconoverNicole Ibrahim, now from G-C Partners, talking about her research into USB storage drivers including MSC, MTP and PTP. You can read Nicole's Blog here: http://nicoleibrahim.com/Lee Whitfield, from Digital Discovery, talking about the forensic 4cast awards which are now available for 2014 nominations! You can nominate someone here: http://forensic4cast.com/2014/01/4cas...

Forensic Lunch 12-20-13 Aug 25, 2015

This week we had:Rob Lee, @robtlee http://computer-forensics.sans.org/, talking about the new SANS FOR 408 class and the interesting journey into Windows 8 forensics.This included some really interesting discussions into artifacts being created across synced devices!Mari DeGrazia, @maridegrazia http://az4n6.blogspot.com/, talking about her research into Google analytics cookies. This included a demo of her tool and its output. It allows you to recover so much more information if your trying to discover not only if a website was visited but at what times and to what extent.Matthew and I talked about detecting files being created from alternative NTFS drivers, such as ntfs-3g, using artifacts within the $MFT only!

Forensic Lunch 11-22-13 Aug 25, 2015

This week Mari DeGrazia join us to talk about her work building a python parser for recovering deleted data from SQLite databases and Eric Zimmerman came on to talk to us about passing the new X-ways Xpert certification and the upcoming OSTriage v2 which will be available for non law enforcement use!You can read Mari's blog here: http://az4n6.blogspot.com/ To read up more on OsTraige read the forensic focus thread here: http://www.forensicfocus.com/Forums/v...

Forensic Lunch 11-15-13 Aug 25, 2015

Forensic Lunch 11/15/13 This week we have Kristinn Gudjonsson and Ryan Benson with us!

Download Kristinn’s Plaso slides from OSDF here:http://blog.kiddaland.net/2013/11/osd… See his blog post regarding the visualization module here:http://blog.kiddaland.net/2013/11/vis… Find the plaso code here: https://code.google.com/p/plaso/

Find Ryan’s Chrome history of artifacts chart here:http://www.obsidianforensics.com/blog… Find Ryan’s tool Hindsight here:http://code.google.com/p/hindsight-in…

Forensic Lunch 11-8-13 Aug 25, 2015

This week we have Sheryl Falk from Winston & Strawn talking about the legal side of breaches, Jonathan Rajewski from Champlain College talking about the undergrad and graduate programs at Champlain and Matthew and myself talking about big new changes in ANJP.

Sheryl is sfalk@winston.com Jonathan is jtrajewski@champlain.edu

Forensic Lunch 11-1-13 Aug 25, 2015

This week on the Forensic Lunch we have David Dym, Rebecca Henderson, Kevin Stokes, Lee Whitfield and myself.

Topics include setmace research and testing, automating metadata extraction with shell and com, manual mobile forensics, lab certification and the intern process in DFIR

Forensic Lunch 10-25-13 Aug 25, 2015

IR Roundtable Part 3:

This week on the Forensic Lunch we finished the IR Roundtable with James Lohman and Kyle Maxwell.

Forensic Lunch 10-18-13 Aug 25, 2015

Dave and Matthew talk about the updated GUI for ANJP, finding the actions programs leave behind in the file system to create signatures and more!

Forensic Lunch 10-11-13 Aug 25, 2015

Forensic Lunch 10/11/13 IR Roundtable Part 2Join us this week as we continue our IR Roundtable from last week with:Darren Windham (NGO)Joseph Shaw (Alvarez)Kyle Maxwell (Verizon)James Lohman (G-C)Great topics regarding how to deal with and scope data exfiltration and dealing with lateral movement and attacker intelligence.

Forensic Lunch 10-4-13 Aug 25, 2015

IR Roundtable Part 1

Forensic Lunch this week is a IR Round Table with:James Lohman (G-C Partners)Kyle Maxwell (Verizon Business)Darren Windham (NGO)Talking about methodologies for approaching incidents, triaging malware and showing ROI to executives

Forensic Lunch 9-27-13 Aug 25, 2015

Guests this week:Harlan CarveyZoltan SzaboJake WilliamsLinks for today:Harlan's Blog: http://windowsir.blogspot.com/Zoltan's Associates Degree: https://www1.dcccd.edu/catalog/progra...Jake's FOR 610 Class: http://www.sans.org/vlive/details/for...

Forensic Lunch 9-20-13 Aug 25, 2015

Links for this week:

For the VCDB You can get an overview here:http://public.tableausoftware.com/vie... for VCDB.The VCDB Github is located here:https://github.com/vz-risk/VCDB And the currently open issues is here:https://github.com/vz-risk/VCDB/issue... You can visit Tzworks here:https://www.tzworks.net/And get the tools shown today here:LNK Parser: https://www.tzworks.net/prototype_pag...Jump list parser: https://www.tzworks.net/prototype_pag...Shellbag parser: https://www.tzworks.net/prototype_pag...GENA here: https://www.tzworks.net/prototype_pag...

Forensic Lunch 9-13-13 Aug 25, 2015

Joachim Metz and Kyle Maxwell talk about maintaining a forensics encylopedia that is accessable to everyone and more!

Forensic Lunch 9-6-13 Aug 25, 2015

Eric Zimmerman discusses forensic imaging tools performance

Phil Hagen talks about his new SANS 572 course

Lee Whitfield asks about building a good forensics box

Forensic Lunch 8-30-13 Aug 25, 2015

Kyle Maxwell talks about CryptoParty

James discusses Outlook Message Conversation Index

Dave and Matt show their Plist Parser

Forensics Lunch 8-23-13 Aug 25, 2015

James talks about parsing MAPI information with a new script.

Kyle talks about research into public data breaches.

Joseph Shaw discusses the insider incidents.

Forensic Lunch 8-16-13 Aug 25, 2015

Recap of the crimes against children conference and a tool update with Brian LockeryTroubles trying to integrate TSK with PerlThe new book website!The experience and value of a bachelors in computer forensics and more!

Forensic Lunch 8-9-13 Aug 25, 2015

David Nides discussing efforts with Plaso.

Joseph Shaw talks about file system forensics.

Kyle discusses the Black Hat defcon challenge.

Forensic Lunch 8-2-13 Aug 25, 2015

Talking about HTML5 Offline cache forensics with Blazer Catzen Life as an internal forensic investigator with Brandon Foley Update on Shadowkit with David Dym Plist carving, parsing and embedded plists within plists Update on the NTFS Triforce and more!

Link to shadowkit: http://redrocktx.blogspot.com/p/shado… Link to fiddler: http://fiddler2.com/ (windows ssl proxy) Link to charles: http://www.charlesproxy.com/ (mac ssl proxy) Link to honeyproxy: http://honeyproxy.org/ (open source ssl proxy)