AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

AboutDFIR Blog Posts Archive

22 Jun 2022
By Mary

InfoSec News Nuggets 06/22/2022

DDoS-for-hire service provider jailed Matthew Gatrel, a 33-year-old man from St. Charles, Illinois, has been sentenced to two years in prison for running websites that provide powerful distributed denial-of-service (DDoS) attacks against internet users and websites. This sentencing resulted in the seizure of his websites, making the internet a little safer from DDoS attacks. Gatrel was the administrator and owner of DownThem.org and AmpNode.com, two DDoS-for-hire websites with thousands of clients which launched attacks against more than 200,000 targets. He was convicted of three…
Read More
18 Jun 2022
By Cassie Doemel

AboutDFIR Site Content Update 6/18/22

SANS held their first Ransomware Summit this week. If you missed it, I grabbed all the links I could and the sessions will be shared by SANS on Youtube soon. I especially liked Kunal Shandil's talk, "Multifaceted Extortion: Analysis of Data Exfiltration TTPs Used by Ransomware Threat Actors" and Jeffry Lang's break down "Kaseya Ransomware Reaction - Lessons Learned".  Tools & Artifacts - Windows - new entries added - Logfile, Tasks, Powershell Logs, VSS Carver,…
Read More
04 Jun 2022
By Cassie Doemel

AboutDFIR Site Content Update 6/4/22

Surprise, not surprise, I posted the research!  Informally, I'd like to break down a little more what it could be useful for. App Timeline Provider logs mouse, keyboard, and audio activity for apps that are in focus on Windows 8+ machines. If you have mouse and keyboard activity within an app, you're validating that the window was "in focus" and that it was interacted with. If you have audio input and audio output, you can…
Read More
23 May 2022
By Cassie Doemel

App Timeline Provider – SRUM Database

The System Resource Usage Monitor (SRUM) is a currently parsed artifact available on Windows 8+ systems. On a basic level, SRUM appears to be the backend database supporting the Task Manager. These tables are stored in an Extensible Storage Engine (ESE) database saved as SRUDB.dat. Generally, there are 30 to 60 days of data saved in this database. The data is written to the database approximately every hour and around shutdowns. Some the tables within…
Read More
21 May 2022
By Cassie Doemel

AboutDFIR Site Content Update 5/21/22

This post is a bit lighter than recently but it's because I've been working on my own research! Hopefully I'll be posted it here in the next week or two in time for the next update. Convenient that today is World Whisky Day because, after all that, I could use a drink.  New Site Post - The Effect of Ransomware After The Investigation by Devon Ackerman Tools & Artifacts - Windows - new entries added…
Read More
18 May 2022
By Devon

The Effect of Ransomware After The Investigation

Ransomware. It’s a word that has become interwoven into the fabric of global corporate, business and legal vernacular. The threat is briefed to executive leadership teams during security update calls and to boards of directors during quarterly earnings calls. Its risks are part of mergers and acquisitions (M&A) strategy planning and are specifically identified in cyber insurance coverage policies with exclusions and sub-limits. And an entire industry exists around threat intelligence, in which the proverbial…
Read More
07 May 2022
By Cassie Doemel

AboutDFIR Site Content Update 5/7/22

Thursday was World Password Day! While I'm sure anyone who finds this page has an excellent professional and personal password policy and/or password manager, don't also forget to convince your friends and family to review their passwords. World Password Day was covered differently by different organizations but the sentiment from me remains - if you're set, make sure those you care about are as well.  Annual Industry Reports- new entries added - PwC Threat Report,…
Read More
23 Apr 2022
By Cassie Doemel

AboutDFIR Site Content Update 4/23/22

Big thing right up front - this is the last site update before the Forensic 4:Cast nominations close -  click here to nominate your favorite or most useful resources!  Annual Industry Reports- new entries added - RIA, Arctic Wolf, and Meta Jobs - new entries added - Raytheon Intelligence & Space, Zachary Piper Solutions, Cognizant, Kyndryl, and Center for Internet Security Tools & Artifacts - Windows - new entries added - Windows Registry, a graphing…
Read More
09 Apr 2022
By Cassie Doemel

AboutDFIR Site Content Update 4/9/22

Keeping it short and sweet today. Hope you're all doing well! Annual Industry Reports- new entry added - 2022 Cyberthreat Defense Report & Cyber Security Breaches Survey 2022 Jobs - new entries added and old cleaned up - New positions include: Kroll, Peraton, Crowdstrike, Secureworks, and the Federal Public Defender's Office in Los Angeles Tools & Artifacts - Windows - new entries added - Pagefile URLs, Battery Levels, & PowerShell Scripts Tools & Artifacts -…
Read More
26 Mar 2022
By Cassie Doemel

AboutDFIR Site Content Update 3/26/22

Happy start of Spring to those in the Northern Hemisphere! Are you in our Forensicators of #DFIR list? If not, maybe you'd like to check out those who are listed there or submit yourself as a resource. Just one of the areas I've been looking at for potential site updates. Speaking of... Annual Industry Reports - new entries added  Jobs - new entries added Scholarships - new entries added/updated - Thanks again to Dave G for…
Read More
12 Mar 2022
By Cassie Doemel

AboutDFIR Site Content Update 3/12/22

Don't forget to Spring Forward tomorrow for those of us that observe daylight savings time! Losing that hour of sleep isn't my favorite but it sounds like it's bringing a bit of warm weather and I'm ready for it. Jobs - new entries added  Annual Industry Reports - new entries added Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS -…
Read More
26 Feb 2022
By Cassie Doemel

AboutDFIR Site Update 2/26/22

It's been a busy two weeks on AboutDFIR so I'll get right to the updates! Jobs - new entries added  Annual Industry Reports - new entries added Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added OSINT Opt-Out Guide - entries added/updated, name changed Early update to the Featured Page of the Month for March On the topic of the Featured Page of the Month, Mark…
Read More
12 Feb 2022
By Cassie Doemel

AboutDFIR Site Update 2/12/22

While science may not entirely support it, Punxsutawney Phil announced 6 more weeks of winter. Hopefully the prediction also includes no extra static in the DFIR world! On to the site updates: Jobs - new entries added  Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Training & Certifications - new entries added focused on MacOS forensics…
Read More
29 Jan 2022
By Cassie Doemel

AboutDFIR Site Content Update 1/29/22

It's National Puzzle Day today! DFIR can be a little like a puzzle -- looking for the pieces to put together to see the bigger picture. Since I don't have a quick DFIR puzzle, here's a small distraction in the form of the Daily Mini Crossword Puzzle from the New York Times. If you don't like Crosswords, you could try the daily word puzzle that's taken over Twitter as of late - Wordle. On to…
Read More
28 Jan 2022
By Cassie Doemel

A Conversation about Transitioning to Incident Response

In working on AboutDFIR the last couple months, I’ve come to learn that while digital forensics and incident response share some basic foundational knowledge, they are widely different in practice. I’ve taken SANS FOR500: Windows Forensic Analysis and have been reading the recent articles about vulnerabilities, and have to say it’s been a series of eye-openers, especially coming from a law enforcement digital forensic background, as to how evidence and analysis can differ depending on…
Read More
15 Jan 2022
By Cassie Doemel

AboutDFIR Site Content Update 1/15/22

It's hard to believe we're already halfway through January! As for the site updates: Jobs - new entries added  Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added DFIR Research - updated links AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: In case you missed it, Abhiram Kumar wrote a post about his experience with…
Read More
11 Jan 2022
By Abhiram Kumar

My Experience: FOR508 & GCFA

A small blogpost on my first ever experience taking a SANS course and my attempt at GCFA.   Intro This was my first time taking a SANS course. I did hear about SANS courses and also many people in the DFIR industry attempt exams for GIAC certifications.   I was a little overwhelmed. I did have a lot of dilemmas in deciding which certification to pursue. The main ones were GCFE (FOR500) and GCFA (FOR508).…
Read More
31 Dec 2021
By Cassie Doemel

AboutDFIR Site Content Update 1/1/22

Happy New Year!! Here's hoping 2022 brings good things to you and yours!  As for the site updates: Jobs - new entries added  Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: In case you missed it, Andrew Rathbun appeared on Chewing the FAT with Phil & Adam…
Read More
18 Dec 2021
By Cassie Doemel

AboutDFIR Site Content Update 12/18/21

Happy Holidays, Round 2! Merry early Christmas! Happy late Hanukkah! Happy early Winter Solstice! Happy early Kwanzaa! If I missed something you celebrate, I apologize but I hope it's amazing. I also hope the DFIR world this time of year is far less exciting through the upcoming holidays than it has been with the log4j/log4shell surprises on the IR side. As for the site updates: Jobs - new entries added (updated weekly) Tools & Artifacts…
Read More
04 Dec 2021
By Cassie Doemel

AboutDFIR Site Content Update 12/4/21

Happy Holidays! It's the first post in December so you're probably going to see that greeting at least once more. Speaking of holidays, it's almost Holiday Hack time! Sign up to be notified for the SANS Holiday Hack and KringleCon 2021 talks at this link or try your hand at the 2020 Holiday Hack while you wait. Don't know what the Holiday Hack is? "The SANS Holiday Hack Challenge is a FREE series of super…
Read More
20 Nov 2021
By Cassie Doemel

AboutDFIR Site Content Update 11/20/21

Hope everyone has a fantastic weekend and if you celebrate, hope you have a Happy Thanksgiving! Jobs - new entries added  Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: In case you missed it, SANS Pen Test HackFest Summit & Training 2021 link board is complete.…
Read More
06 Nov 2021
By Cassie Doemel

AboutDFIR Site Content Update 11/6/21

First update of November!  Jobs - new entries added - added expiration column Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Looking forward to attending SANS Pen Test HackFest Summit & Training 2021 - Live Online. The free virtual summit portion is November 15 & 16…
Read More
23 Oct 2021
By Cassie Doemel

AboutDFIR Content Update 10/23/21

End of October update! Jobs - new entries added - added expiration column Annual Industry Reports - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Looking forward to attending SANS Pen Test HackFest Summit…
Read More
09 Oct 2021
By Cassie Doemel

AboutDFIR Content Update 10/09/2021

Over the last year with the new virtual options for SANS Summits, I've started attending a few and each time I've saved the links I could from the Slack before it goes down at night. Yesterday was the last day of the SANS Threat Hunting Summit so I have a new start.me board full of links for you to view if you're interested! SANS Threating Hunting Link List. Just a few site updates this round!…
Read More
25 Sep 2021
By Cassie Doemel

AboutDFIR Content Update 9/25/2021

I've been crawling through some of the older content on AboutDFIR and making some updates. If there's something you think needs more immediate attention, don't hesitate to throw a note in the site feedback form and I can start there. Annual Industry Reports - new entries added Law Enforcement Opt-Out Guide - new entries and updates Tools & Artifacts - Windows - new entries added, old entries updated AboutDFIR stickers are a thing! If you're…
Read More
11 Sep 2021
By Cassie Doemel

AboutDFIR Content Update 9/11/2021

Cassie bringing the update this week! I'm immersing myself in the DFIR world so it made sense to couple that up with some research and doing the Site Update was a perfect excuse to make it happen. On September 21st, Josh Mitchell and Andrew will be putting on a Webinar regarding the new DFIR artifact they've been researching called EventTranscript.db. Register for the webinar here! As always, you can find Andrew and his work on…
Read More
29 Aug 2021
By Cassie Doemel

First Time GIAC: Studying for the GCFE

Reading about SANS courses and GIAC certifications prior to this experience was a little overwhelming. Depending on dozens of factors, people that post online seem to have either a good or terrible experience. Forums say anything from “agonize over every word” to “passed without the class” with not enough background to quickly figure out what side of the spectrum you might be on.  So, I’ll put that up front: In my current role, I am…
Read More
27 Aug 2021
By Mary

InfoSec News Nuggets 08/27/2021

Quantum computers could read all your encrypted data. This 'quantum-safe' VPN aims to stop that To protect our private communications from future attacks by quantum computers, Verizon is trialing the use of next-generation cryptography keys to protect the virtual private networks (VPNs) that are used every day by companies around the world to prevent hacking. Verizon implemented what it describes as a "quantum-safe" VPN between one of the company's labs in London in the UK and a US-based…
Read More
26 Aug 2021
By Andrew Rathbun

AboutDFIR Content Update 8/26/2021

The Forensic 4:cast Awards update is here: Jobs - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like:   My colleague Josh Mitchell and I will be putting on a Webinar regarding the new DFIR…
Read More
22 Aug 2021
By Tony Knutson

SOF-ELK and Integration with KAPE

Archer: FX  Amazing how fast time flies when you're juggling so much during the trying times we all have since 2020! At at the time of publishing this article, we are all still facing a lot of uncertainties. I hope time has been gracious to you all...and continues to be!  Why this post?  As we push through some very trying times in the Digital Forensic and Incident Response world, there are two things I've experienced…
Read More
08 Aug 2021
By Andrew Rathbun

AboutDFIR Content Update 8/8/2021

A huge backend update to AboutDFIR has arrived: Migration of all data tables on the site from WPDataTables to TablePress Main benefit: data within the tables are now searchable sitewide! As a result, most tables were refined in some form or another Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If…
Read More
26 Jul 2021
By Andrew Rathbun

AboutDFIR Content Update 7/26/2021

The Forensic 4:cast Awards update is here: Awards - updated for 2020 Awards that just occurred as well as adjusted years to be more accurate Certifications & Training - new entries added Tools & Artifacts - Windows - new entries added Tool Testing - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards were last week. AboutDFIR…
Read More
17 Jul 2021
By Andrew Rathbun

AboutDFIR Content Update 7/15/2021

AboutDFIR's mid-July update arrives: Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards voting period is open! Please be sure to vote for AboutDFIR if you feel we've served you well in 2020!…
Read More
02 Jul 2021
By Andrew Rathbun

AboutDFIR Content Update 7/2/2021

The first update of July arrives: Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia- new entries added Tools & Artifacts - File Systems - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards…
Read More
19 Jun 2021
By Andrew Rathbun

AboutDFIR Content Update 6/19/2021

Lots of Windows artifact updates this week: Tools & Artifacts - DVR/Multimedia- new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards voting period is open! Please be sure to vote for AboutDFIR if you feel we've served you well in 2020! Vote here! I've been continuing lots of…
Read More
11 Jun 2021
By Mary

InfoSec News Nuggets 06/11/2021

How to Protect Seniors Against Cybercrimes and Scams Many of the crimes that occur in real life happen on the internet too. Credit card fraud, identity theft, embezzlement, and more, all can be and are being done online. Seniors and the elderly are often targeted for these cybercrimes. They tend to be more trusting than younger people and usually have better credit, and more wealth. This makes them more attractive to scammers. Seniors are considered…
Read More
05 Jun 2021
By Andrew Rathbun

AboutDFIR Content Update 6/5/2021

The first update of June awaits: Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia- new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Sorry for the delay in posting.…
Read More
08 May 2021
By Andrew Rathbun

AboutDFIR Content Update 5/8/2021

The first update of May awaits: Tools & Artifacts - Android - new entries added Tools & Artifacts - Linux - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards are open for the year 2020. If you feel that AboutDFIR served you well in 2020, we would…
Read More
19 Apr 2021
By Andrew Rathbun

AboutDFIR Content Update 4/19/2021

Yet another AboutDFIR update: KAPE Guide - new links added Timeline Explorer Guide - new links added Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards are open for the year 2020. If…
Read More
10 Apr 2021
By Andrew Rathbun

AboutDFIR Content Update 4/10/2021

The first update of April is below: Awards - updated with info about the Forensic 4:cast Awards for 2021 Certifications & Training - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us…
Read More
27 Mar 2021
By Andrew Rathbun

AboutDFIR Content Update 3/27/2021

The "I can't believe March is almost over already" update: Awards - updated with info about the Forensic 4:cast Awards for 2021 Certifications & Training - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The 2021 Forensic 4:cast Awards are open for the year 2020. If you feel that AboutDFIR served you…
Read More
12 Mar 2021
By Andrew Rathbun

AboutDFIR Content Update 3/12/2021

The "I can't believe March is halfway over already" update: Annual Industry Reports - lots of new entries added Tool Testing - new images for macOS and iOS 14 from Josh Hickman Tools & Artifacts - Android - new entries added Tools & Artifacts - File Systems - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If…
Read More
21 Feb 2021
By Andrew Rathbun

AboutDFIR Content Update 2/21/2021

The second AboutDFIR update of February 2021 is here: Tool Testing - new images for macOS and iOS 14 from Josh Hickman Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Not a lot of sections of the site updated this week, but lots of new, useful content added within those two sections. Check them out!…
Read More
11 Feb 2021
By Andrew Rathbun

AboutDFIR Content Update 2/11/2021

The first AboutDFIR update of February 2021 is here: Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I've been continuing lots of work on GitHub to help improve…
Read More
29 Jan 2021
By Andrew Rathbun

AboutDFIR Content Update 1/29/2021

Yet Another AboutDFIR Update: Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I've been continuing lots of work on GitHub to help improve the KAPE, RECmd, and EVTXECmd…
Read More
12 Jan 2021
By Andrew Rathbun

AboutDFIR Content Update 1/12/2021

The first update of 2021 is here: KAPE Guide - added links to KAPE Target Guide and Template Tools & Artifacts - Android - new entries added Tools & Artifacts - File Systems - new entries added Tools & Artifacts - iOS - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: For those who use Eric Zimmerman's Tools, make sure you're…
Read More
31 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/31/2020

Happy (almost) New Year and with that, the last update of 2020: Annual Industry Reports - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: 2020 was an awesome year for AboutDFIR. We saw the…
Read More
18 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/18/2020

Likely the last site update post of the year: Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added Tools & Artifacts - Linux - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: This week saw the release of the MFT Explorer/MFTECmd Guide. Check…
Read More
17 Dec 2020
By Andrew Rathbun

Introducing AboutDFIR’s MFT Explorer/MFTECmd Guide

Greetings everyone! I’ve been working on a detailed guide geared towards LE/Private Sector examiners who’ve never used MFT Explorer/MFTECmd before as well as anyone looking to learn what the tool is all about. Learning a new tool is intimidating and can be frustrating, but hopefully this guide will make things easier. The MFT Explorer/MFTECmd Guide comes on the heels of the previous guides I put together recently: KAPE, Timeline Explorer, and Registry Explorer/RECmd. All guides,…
Read More
05 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/5/2020

After a short break, we're back: Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I finally put the GCFA behind me and thankfully I passed! I will be…
Read More