DFIR: Sunday Reading
After catching up on my RSS feeds this morning, there are a few articles that I thought I would share.
- 2014 Forensic 4 Cast Awards: Have you submitted your nomination?
- The Volatility team has a good blog post up regarding POS (Point of Sale) Malware that was allegedly used in the Target data breach.
- Master Linux forensicator and SANS Instructor Hal Pomeranz has started a GitHub with his perl scripts that he uses in forensic examinations.
- @jackcr's Handler Diaries Blog: Keeping Focus During An Incident is a good read for the incident responder.
- Unless you have been living under a rock, you probably follow Harlan's Windows IR blog and Corey's Journey Into IR blog. Both are superb resources for the forensic examiner and incident responder.
- David Cowen's HECF Blog is updated daily. Every Friday, David and his team host the Forensic Lunch. This past week's show featured Sarah Edwards and Craig Ball. Sarah discussed her upcoming Mac Forensics course with SANS. I've met Sarah and have heard her speak. Being a Mac forensicator, I am looking forward to this course. Craig Ball, Esq. discussed his role in being a Special Master in civil courts and brought an excellent perspective of digital forensics in the American court system. If you are a forensic examiner, make sure you watch his segment on the Forensic Lunch.
- Shellbag Forensics by Dan Pullega shared his research to his blog last month and is continuously updating it. Dan's research is being updated regularly (01.14.2014). Dan has done some groundbreaking research and if you are looking for someone to nominate for the 2014 Forensic 4cast Awards, this would be someone you should consider.
- Finally this Sophos article also caught my attention, Anonymous Yelp reviewers must be outed, US Court rules. This article points out,"...that anonymous users aren't covered by First Amendment protection of free speech if a review is "based on a false statement"...". As a society and with the evolution of technology, people have generally become desensitized. Don't say something online that you would not say or feel comfortable saying in person. So remember, spreading false information does not carry First Amendment protection of in itself. If you are interested in reading excellent articles and case studies on cyber crime and cyber conflicts I would recommend Susan Brenner's Cyb3rCrim3 blog. Another great legal resource is Benjamin Wright's blog at http://hack-igations.blogspot.com
Hello World
Would there be any other way to welcome you to my new site? So, where have I been? 2013 brought a lot of changes for me professionally and personally. 2014 is looking even brighter! I've always enjoyed blogging and I do plan on being active in 2014, especially since I now have prime real estate space. Please, if you read my blog drop me a comment or two, as it'll help keep me motivated to deliver regular, fresh content! So, what can you expect here? Some news, commentary, and things I am working on in #DFIR. So who is my intended audience? Fellow colleagues (forensic examiners), clients, academia, and anyone wanting to know more about digital forensics. In the future, posts targeted to DFIR colleagues will be tagged as DFIR for your RSS feeds. Since transitioning from LE DFIR to private DFIR consulting, I continue to be a resource for people and businesses in making transactions via the World Wide Web, where forensic technology services can play a critical role in civil litigation, as well as key business and personal decisions. This blog and site will be a single repository and venue for me to share and hopefully further engage with colleagues and clients via a single medium. Now, that I've got my first post out of the way...let's roll!
For those of you attending the 2014 SANS DFIR Summit, see you there!