Avançar para o conteúdo principal

Yet Another DFIR Blog!

Well yes. I created another Digital Forensics & Incident Response Blog. You may ask why. I recently read the Rob Lee[1] and Harlan Carvey[2] blog posts and was motivated to give something back to the community.

I am by no means an Expert Forensicator like some heavy hitters in the community but I am willing to share my knowledge and learn with you if you so choose to write a comment to my upcoming blog posts.

So Who Am I?

I am a digital forensics & incident response Portuguese consultant. I work from the most simple incident/digital forensic investigation to enterprise wide engagements in some critical infrastructure in Portugal.

I recently finished SANS FOR508 and got my GCFA.

I hope with this blog I can improve the body of knowledge in the digital forensics & incident response industry and get some fun out of it.

Feel free to get in though with me. I would love to hear from you.


[1] https://www.sans.org/blog/how-to-make-a-difference-in-the-digital-forensics-and-incident-response-community/
[2] http://windowsir.blogspot.com/2011/12/stuff_13.html

Comentários

Mensagens populares deste blogue

Forensic Analysis of Revo Uninstaller Pro

In a recent engagement I found an application that I never encounter before. I searched a bit online but I couldn't find any articles related to this application and the artifacts it leaves behind. This guide is by no means an exhaustive examination of the application. Revo Uninstaller Pro[1] is an application that enabled the users to remove applications from the computer. But the most interesting feature is that it enabled the user to remove some Windows Artifacts like, Web History, Search History, UserAssist, comDlg32, etc. Windows Registry Artifacts While installing the tool I found that it creates Windows Registry keys in the user NTUSER.DAT Hive. The location of the data is " Software\VS Revo Group\Revo Uninstaller Pro\". The " TrackCleaner " subkey stores the user settings responsible for deleting various windows artifacts. The Last Write Time is not the last execution date but the last time that the user changed the settings. For exa...