Thoughts on Digital Forensics & Incident Response

A couple of months ago I finished reading my first Harlan Carvey book - Windows Registry Forensics. I must say I loved it and learn a lot. Chapter 1 - Registry Analysis - In this chapter Harlan introduces the foundations needed to build the knowledge he intended to share with the book. It goes into the Microsoft Windows Registry internal structure and basics Digital Forensics investigation principals like the Locard's Exchange Principal and the Least Frequency of Occurrence. I really like this phrase. Something that is very important to keep in mind when considering whether to engage in live response activities ( as opposed to acquiring and image of the hard drive and conducting postmortem analysis) is that while actions do have an effect on the system (processes loaded into memory, files created on the system as a result of your actions, etc) so does your inaction .  - Harlan Carvey , Windows Registry Forensics Chapter 2 - Processes and Tools - This chapter presents s...

Well yes. I created another Digital Forensics & Incident Response Blog. You may ask why. I recently read the Rob Lee[1] and Harlan Carvey[2] blog posts and was motivated to give something back to the community. I am by no means an Expert Forensicator like some heavy hitters in the community but I am willing to share my knowledge and learn with you if you so choose to write a comment to my upcoming blog posts. So Who Am I? I am a digital forensics & incident response Portuguese consultant. I work from the most simple incident/digital forensic investigation to enterprise wide engagements in some critical infrastructure in Portugal. I recently finished SANS FOR508 and got my GCFA. I hope with this blog I can improve the body of knowledge in the digital forensics & incident response industry and get some fun out of it. Feel free to get in though with me. I would love to hear from you. [1] https://www.sans.org/blog/how-to-make-a-difference-in-the-digital-forensics...