Tag Archives: Forensics

Challenge #7 – SysInternals Case

Posted on 27 March 2023 by [email protected]

The user downloaded what they thought was the SysInternals tool suite, double-clicked it, but the tools did not open and were not accessible. Since that time, the user has noticed that the system has “slowed down” and become less and … Continue reading →

Posted in Challenges, DFIR, Forensics, Investigations, Malware | Tagged , , , , , , | Comments Off on Challenge #7 – SysInternals Case

Linux Forensics Workshop

Posted on 13 May 2020 by [email protected]

Hello, I’ve been invited by the Saudi Federation for Cyber Security and Programming (SAFCSP) to do a Linux Forensics workshop during their series of Cybersecurity Nights. My session will be next Thursday, May 14th, 2020 at 10:00 PM (KSA time) … Continue reading →

Posted in Forensics, Investigations, Workshops | Tagged , , , , | Comments Off on Linux Forensics Workshop

Investigating USB Drives using Mount Points Not Drive Letters

Posted on 4 April 2020 by [email protected]

Yes, another excellent question came up by one of my students: If a user mounts the volume to a mount point, what artifacts could we find for the USB? Starting I think from Windows 8.1 or 10, a user could … Continue reading →

Posted in DFIR, Forensics, Investigations, Windows | Tagged , , , , , , , , | Comments Off on Investigating USB Drives using Mount Points Not Drive Letters

Acquiring Linux Memory using AVML and Using it with Volatility

Posted on 20 June 2019 by [email protected]

This is another quick post going over the process to acquire memory from a Linux system, but instead of using LiME, I’m going to use AVML which stands for Acquire Volatile Memory for Linux, and could be found here. The … Continue reading →

Posted in DFIR, Forensics, Memory, Software/Tools | Tagged , , , , , , , | Comments Off on Acquiring Linux Memory using AVML and Using it with Volatility

Forensic Analysis: Creating User GUI vs CLI

Posted on 7 January 2015 by [email protected]

Hello, This is my first forensic analysis post in English; as I’m sure you noticed by now that all of it is in Arabic; so excuse me for my bad English :) The whole idea came out when @azeemnow asked … Continue reading →

Posted in Forensics, Windows | Tagged , , , , , | Comments Off on Forensic Analysis: Creating User GUI vs CLI