AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

AboutDFIR Blog Posts Archive

02 Mar 2020
By Andrew Rathbun

AboutDFIR Content Update 3/2/2020

Greetings! The first update of March 2020 is detailed below:  Preservation Letter/Search Warrant Templates - all templates got a once over with some new language relating to US Code 2703(f), plus Google, Twitter, and Microsoft were added to the bunch Podcasts - new podcast added (SANS GIAC Podcast) Tools & Artifacts - Windows - new blog post entry added Challenges & CTFs - multiple new entries added Jobs - data table has been cleaned up…
Read More
28 Feb 2020
By Andrew Rathbun

My Take on Preparing for GIAC Certification Exams

Introduction SANS GIAC Certifications are highly sought after because of the technical expertise required for completing them successfully. They are not to be taken lightly and are held in high regard due to them not being a “gimme” for the test taker. If you do not prepare, your score will reflect that and you risk not passing. The stakes are high due to the cost of the certification ($789 per attempt as of this writing…
Read More
23 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/23/2020

Greetings! Another content update in the wake of Phill Moore's new This Week in 4n6 post:  Challenges & CTFs - new entries with walkthroughs added Men of #DFIR - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added White Papers - new entry added (DFRWS Papers & Presentations) Did you know that you can add AboutDFIR's newsfeed easily to your Feedly account? Just…
Read More
22 Feb 2020
By Devon

I want to see your Resume!

Do you know of someone just graduating with their college degree in #DFIR or #CyberSecurity or #security looking for their first job? I am interested! Send me a resume -> devon.ackerman@kroll.com with Resume in the subject line. Tag your friends, tag your colleagues.
Read More
20 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/20/2020

Greetings! A relatively small site content update but please see other important items below:  Scholarships - added SANS' Ken Johnson Scholarship 2020  Tools & Artifacts - Linux - added new GitHub resource by ashemery First off, the 2020 Forensic 4:cast Awards Nominations are now open! Be sure to cast your nominations before May 15th, 2020. In the meantime, brush up on the past years' winners on the Awards page.  Secondly, Humble Bundle, one of my…
Read More
17 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/17/2020

Greetings! Yet another update as detailed below:  Annual Industry Reports - added new entries Tool Testing - added Josh Hickman's new Android 10 Image  Tools & Artifacts - Windows - new blog post entries added Tools & Artifacts - DVR/Multimedia - new blog post entries added Tools & Artifacts - iOS - new blog post entries added Infographics - added an awesome link containing many useful cheatsheets, be sure to check it out If there's…
Read More
11 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/11/2020

Greetings! Small update this week but there are bigger things coming:  Certifications & Training - added Brian Carrier's Autopsy course (Free for LE!) Tools & Artifacts - File Systems - reworked data table entirely and added new entries Tools & Artifacts - iOS - new blog post entries added Tools & Artifacts - Android - new blog post entries added I'm working on a blog post regarding my take on preparing for GIAC Certification exams. Look…
Read More
05 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/5/2020

Greetings! Yet another AboutDFIR Content Update:  Preservation Letter/Search Warrant Templates - Discord - updated this page with a section about how Discord Nitro factors into the #XXXX discriminator at the end of a subject's username. I also added a fancy GIF created with my favorite GIF creation tool, ShareX. Also, I added another line in the language asking for historical usernames and discriminators for a specified account Awards - added links to each respective award…
Read More
02 Feb 2020
By Andrew Rathbun

AboutDFIR Content Update 2/2/2020

Greetings! Yet another AboutDFIR Content Update:  Certifications & Training - added KAPE certification course listing and corrected a few errors within the data table Social Media - added a link to Metaspike Community Tool Testing - added a link to new memory images courtesy of Alissa Torres (@sibertor) Tools & Artifacts - iOS - added new blog post entries Tools & Artifacts - Windows - added new blog post entries Tools & Artifacts - Android…
Read More
28 Jan 2020
By Andrew Rathbun

AboutDFIR Content Update 1/28/2020

Greetings! The site continues to evolve as detailed below:  Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - lots of new entries added including Sarah Edwards' fantastic mac4n6 blog posts Lots of data table standardization has taken place with better consistency in column titles across all pages Awards - added headings for the two awards to increase readability on mobile and in general Home Page - RSS feed link…
Read More
24 Jan 2020
By Andrew Rathbun

AboutDFIR Content Update 1/24/2020

Happy Friday! The site continues to evolve as detailed below:  Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows, Linux, MacOS - Velociraptor hands-on video added Jobs - new jobs are being posted on an almost daily basis Challenges & CTFs - added links to and solutions for every SANS Holiday Hack Challenge in the 2010s as well as a few other new challenges Tools & Artifacts - DVR/Multimedia - new…
Read More
15 Jan 2020
By Andrew Rathbun

AboutDFIR Content Update 1/15/2020

Greetings! The site continues to evolve as detailed below:  Home Page - added a Featured Page of the Month. Look for this to update on or around the beginning of each month for a new featured article Tools & Artifacts - iOS - added Checkm8 and Checkra1n Cellebrite Webinar to the data table as well as a link to iDevice firmware downloads Certifications & Training - updated Belkasoft's training offerings Password Cracking - added PDFCrack…
Read More
12 Jan 2020
By Andrew Rathbun

AboutDFIR Content Update 1/12/2020

Greetings! The site continues to evolve as detailed below:  Home Page - a favicon has been added to the site  Tool Testing - added a blurb about Arsenal Image Mounter for mounting forensic images Social Media - added a few more subreddits relevant to the DFIR world Men of #DFIR/Women of #DFIR - new entries added and old ones removed Submit a Job - added a link to the beginning of the job submission process…
Read More
04 Jan 2020
By Andrew Rathbun

AboutDFIR Content Update 1/4/2020

Greetings! First update of the year/decade below:  Forensic Terms - added the definition for Firehose Programmers per a request from the Digital Forensics Discord Server Men of #DFIR - multiple new entries added Tool Testing - new entries added Challenges & CTFs - lots of old entries removed, new entries added, Walkthrough column added and entries added for challenges that have walkthroughs I'm continuing to chip away at the to-do list as well as keeping…
Read More
30 Dec 2019
By Andrew Rathbun

AboutDFIR Content Update 12/30/2019

Greetings! The last update of the decade is detailed below: Men of #DFIR - new entries added Instagram - added Search Warrant and Preservation Letter template language for Instagram Mobile Devices/Computers - added Search Warrant and Preservation Letter template language for Mobile Devices/Computers Every data table should now be mobile friendly with collapsing columns to fit the respective width of your mobile devices. If there are any that aren't translating well on the mobile experience,…
Read More
18 Dec 2019
By Andrew Rathbun

AboutDFIR Content Update 12/18/2019

Greetings! Lots of updates detailed below: Tool Testing - this is a new page that was added to organize all links to sites that host forensic images that can be used for tool validation. Many of the links were taken from Challenges & CTFs so now their new home is here Tools & Artifacts - Windows - a few new resources were added here that I learned about in a recent Magnet Forensics class (AX250)…
Read More
17 Dec 2019
By Tony Knutson

Jailbreaking – Checkra1n Configuration

In this installment, I felt that I should discuss how to use Checkra1n, and how to actually get into the device via 2 methods: localhost (tethered) and WiFi (untethered). This is not a blog to discuss how Checkra1n is doing, what it is doing, or what Checkm8 is doing prior to the device booting. Additionally, you do this at your own risk. Just because it works on one device does not mean it'll work on…
Read More
16 Dec 2019
By Tony Knutson

Pattern of Life – Tracking Through Mobile Applications

So getting back into blogging finally! Thanks for hanging in there with me.  Unlike my last posts, time to roll up the sleeves and try to make this community better from a technical perspective. To do that, I've decided to look at individual applications from iOS (first) so I can see what we are looking at. This is most important to me, because as we all know, our tools will lie to us if we…
Read More
12 Dec 2019
By Andrew Rathbun

AboutDFIR Content Update 12/12/2019

Greetings! The latest changes are detailed below: Challenges & CTFs - new CTFs have been added Jobs - there's been multiple new postings In other news, I passed the GCFE after a few months of studying! I now have more free time available to work on my ever-growing to-do list for this site. Next on the list is to go through the painstaking process of standardizing the layout of all data tables on the site.…
Read More
06 Dec 2019
By Andrew Rathbun

AboutDFIR Content Update 12/6/2019

Greetings! The site continues to evolve and grow: Tools & Artifacts - Windows - added a few tools and links to videos/blog posts to the data table, removed empty entries Videos/Webinars - added a few new YouTube channels Preservation Letter/Search Warrant Templates - Facebook - I updated quite a bit of this page to cater it more to Facebook since their portal requires a different process than most other companies Jobs - there's been multiple…
Read More
02 Dec 2019
By Andrew Rathbun

AboutDFIR Content Update 12/2/2019

Greetings! More changes happening with plenty more to come: Every hyperlink on the site now should be in blue text to make it easier to distinguish between regular black text. I know for me this is a very welcome change! The home page menus have gone through an extensive reorganization and will continue to be refined until we're at a logical resting point. Look for some pages to be merged with others as content grows.…
Read More
27 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/27/2019

Greetings! There's been some new additions to the site that I am excited to share and expand upon as time goes on. Without further ado: Preservation Letter/Search Warrant Templates - This is a new section on the site that I look to flesh out quite a bit as time goes on and needs arise. If anyone has any preservation letter/search warrant language they need, please let us know! Alternatively, if there's some language that has…
Read More
25 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/25/2019

Greetings! I added a couple new pages to the site so I wanted to share the news with a quick blog post: Cell Tower Mapping - I've added some resources to this page that was useful to me when I was a Detective. I hope others can find them useful, as well Password Cracking - I've added links to multiple password lists as well as the Hashcat Wiki. Everyone should poke around rockyou.txt and see…
Read More
22 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/22/2019

Happy Friday, all! Yet another minor update that I wanted to be brought to everyone's attention: Tools & Artifacts - Android - added links to Scott Lorenz's groundbreaking and informative EDL Mode guides: Mastering EDL Mode and Mastering EDL Test Points Social Media - added link to 13Cubed's YouTube channel which has many useful videos relating to various sub-disciplines of Digital Forensics including but not limited to Linux, Windows, Hashcat, Memory Forensics, etc. Also added…
Read More
19 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/19/2019

Happy Tuesday, all! Minor update today so this will be another short one: Tools & Artifacts - Windows - more blogs posts for new and existing artifacts.  Tools & Artifacts - iOS - more blogs posts for new and existing artifacts.  Tools & Artifacts - OS X - more blogs posts for new and existing artifacts. AboutDFIR Home Page - site title has been updated so blog feeds should now read as AboutDFIR - The…
Read More
17 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/17/2019

Happy Sunday, all! Minor update today so this will be a short one: Tools & Artifacts - Windows - more blogs posts for new and existing artifacts.  Tools and Artifacts - File Systems - added a couple blog posts to start out. More to come in due time. AboutDFIR Home Page - a couple broken links have been updated.  Cheers, Andrew
Read More
16 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/16/2019

Today's update is about fixing some readability issues on mobile devices with the data tables. I went through the entire site A-Z on my Google Pixel 2 XL to identify mobile readability issues and I think I've fixed them all. As a result, the following pages have been updated to provide a much more pleasant mobile experience: Tools & Artifacts - Android Tools & Artifacts - File Systems Tools & Artifacts - iOS Tools &…
Read More
15 Nov 2019
By Andrew Rathbun

AboutDFIR Content Update 11/15/2019

Happy Friday everyone! Expect a higher tempo of posts from me regarding site content updates. As long as I change something on the site on a given day, I will make a quick blog post about it. This will allow me to keep everyone abreast on all the changes occurring on this site and to ensure everyone is aware of what information is being updated in a more timely manner. I will start with the…
Read More
10 Nov 2019
By Andrew Rathbun

Just Another AboutDFIR Content Update

I hope everyone is having a great weekend! This has always been one of my favorite times of the year as a Veteran and (former) Marine. Today is the USMC's 244th birthday and tomorrow is Veteran's Day! For those who fall into my very same demographic, this is a great couple of days for us to celebrate and reflect. I am looking forward to celebrating those who've served before me and remembering all the sacrifices…
Read More
09 Oct 2019
By Andrew Rathbun

An Overview of Recent and Future Content Updates

Happy Wednesday to everyone! We are halfway to the weekend and with that I bring to light some updates the site has experienced since I've joined the AboutDFIR team. Again, I'd like to thank Devon Ackerman for giving me the opportunity to contribute to a site in which I've long admired from afar. The Scholarships page has been updated with many new scholarships for DFIR students. I've also added an expiration date column so both…
Read More
22 Sep 2019
By Devon

281 Arrested Worldwide in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes

Federal authorities announced today a significant coordinated effort to disrupt Business Email Compromise (BEC) schemes that are designed to intercept and hijack wire transfers from businesses and individuals, including many senior citizens.  Operation reWired, a coordinated law enforcement effort by the U.S. Department of Justice, U.S. Department of Homeland Security, U.S. Department of the Treasury, U.S. Postal Inspection Service, and the U.S. Department of State, was conducted over a four-month period, resulting in 281 arrests…
Read More
20 Sep 2019
By Andrew Rathbun

New AboutDFIR Contributor

Greetings all, my name is Andrew Rathbun. For more about my background, see my entry on this page. I am excited to be given the opportunity to contribute to AboutDFIR as it is a project I have admired from afar for as long as I knew of its existence. This compendium is akin to something I would create myself had it not already existed. A compendium of this magnitude caters to my interests as a…
Read More
19 Aug 2019
By Andrew Rathbun

InfoSec News Nuggets 08/19/2019

1 Apple's warning: Break Safari's web-tracking rules and we'll hit back ITP broadly aims to limit marketers from tracking iOS and macOS Safari users across different websites, but without impeding a marketer's ability to measure the performance of their online ads. The document outlines what Apple considers to be tracking, different types of tracking, the types it will prevent, and how it treats any attempt to bypass its anti-tracking measures. The company warns it will…
Read More
17 Aug 2019
By Devon

Holiday Hack Sneak Peek 2019

It seems the SANS Annual Holiday Hack Challenge buzz begins earlier and earlier every year.  This year is no exception.  My first HolidayHack CheatSheet of the season is here! HUGE shout-out to our Red Team mole, Stephen Sampana for infiltrating Ed Skoudis' party in Vegas during BlackHat/DEFCON/BSides week and reporting back clues. Download v1.0 of my Kringle Con CheatSheet NOW! Enjoy! In other news, I've added some new items to our site that may interest…
Read More
11 May 2019
By Devon

Weekend of Updates

Looking for Annual Reports on Industry Threats and Trends? https://aboutdfir.com/annual-industry-reports/ Overhauled Blog page to now focus on corporate and blogs not associated with any one specific author.  All of the author specific data has been pulled out and dropped into Men of #DFIR and Women of #DFIR pages. https://aboutdfir.com/reading/blogs/
Read More
10 May 2019
By Devon

#women in #dfir

Across the Cyber Security, Info. Security, and DFIR industries, women are enhancing the ranks of investigative digital sciences to solve problems, investigate crimes, and protect networks. Many organizations have been formed to recognize women who are entering the market, completing higher education in Digital Forensics, and leading in innovation, speaking engagements, and research projects. https://aboutdfir.com/women-of-dfir/ is now live and dedicated to those women.  More to be added in the coming months.
Read More
17 Apr 2019
By Devon

Site Update to DFIR Research page

Jessica Hyde (@B1N2H3X) and Jonathan Wiley with a fresh idea for creation of a forensic image for public consumption, testing, and educational purposes of device running iOS 10 with robust documentation! https://aboutdfir.com/dfir-research/ page updated!
Read More
13 Apr 2019
By Devon

Site Updates

Busy weekend with new Certification and Training courses added, new Incident Response/Breach report added, DFIR Research additions and updated links, and even new tool updates.
Read More
04 Apr 2019
By Tony Knutson

Magnet User Summit 2019 Impressions

I wanted to make a quick note to start the blogging back up again (yes, I know -- don't judge me!) by discussing a recent Digital Forensics Summit that took place during the first week of April here in the United States. While there is some bias to this since both Devon and myself did present at the Summit, there is in no way, shape or form any endorsement or payment from Magnet for what…
Read More
19 Mar 2019
By Devon

Catching Up 3/19/2019

I’m overdue for an update, so here we go!  I came across some pretty cool stuff recently.  I know I’ve said this before, but it really is a fantastic time to be involved in DFIR! Nick Caldwell won me over with the very first article of his I came across, and he hasn’t disappointed me since!  He’s such a solid force of wisdom: https://hackernoon.com/the-worst-career-advice-i-ever-received-54aaf2a50c93 https://medium.com/@nickcaldwell/latest @NickCald Unless you live in a cave, you probably already knew this, but Eric…
Read More
27 Jan 2019
By Devon

Catching Up

I took some time this weekend to catch-up a bit with AboutDFIR and add some of the content I've been too busy to share.  I've got tons more, so that will be coming as time allows.  I know Devon has stated it, but I'll reiterate, the links that we add often have context and so I've decided to take a few minutes to add some backstory around the new additions I've made this weekend. First,…
Read More
20 Jan 2019
By Devon

AboutDFIR.com updates across the board

Tons of updates across the website this weekend to include the new Tools section: Tools & Artifacts - Android Tools & Artifacts - File Systems Tools & Artifacts - Windows In addition, the existing Conferences page received a big update with the addition of CFP information.
Read More
13 Jan 2019
By Devon

Forensic Tools

Forensic tools, whether software or hardware, or just like traditional forensic science tools - they are designed by humans and typically meant to be used by trained users who understand both the artifacts they are processing as well as the results produced by the tool. Some tools are as simple as a USB write blocker - you plug one end into a computer, you plug a USB device into the other end, and it "just…
Read More
06 Jan 2019
By Devon

Episode 886: The Price Of A Hack

"The Price of a Hack" w/Chris DiIenno of Mullen Coughlin LLC law firm, experts in legal advice following or during a cyber security event, along w/Dina Temple-Raston of NPR. This piece was born out of a prior Kroll Cyber Risk digital forensics and incident response-related investigation, directed by legal counsel, to assist a client they was preyed upon via a Business Email Compromise-oriented targeting scheme. NPR Planet Money - Episode 886 "The Price Of A…
Read More
03 Jan 2019
By Devon

Android Nougat Image Available to the DFIR Community

Joshua Hickman has created, for the DFIR community, an image of Android 7.x (Nougat) populated with apps and test data for a wide range of usage - everything from testing tools to training to teaching. It was created using a stock Android image from Google.  Several popular applications (apps) were populated with user data utilizing the capabilities of each individual app.  The stock Android apps were also populated with user data. An LG Nexus 5x,…
Read More
01 Jan 2019
By Devon

Threat Hunting for Non-Threat Hunters

Posted by MIKE ART REBULTAN at https://www.peerlyst.com/posts/threat-hunting-for-non-hunters-mike-art-rebultan-mit-ceh-ecsa. Threat hunting is a proactive task with an assumption that your organization has already been breached and you wanted to beat the average “dwell time” of 256 days; at least for me as a DFIR practitioner. And this is usually done with the help of different tools that we call “arsenals”; SIEM (security information and event management) and EDR (endpoint detection and response) mostly. However, security is not…
Read More
10 Dec 2018
By Tony Knutson

SANS SEC401 – Comprehensive Review

To get started in InfoSec, One must drink from the fire hose eventually  First, I want to apologize for the very late and posts over the last month or so. My life has been a little chaotic bouncing between a few different things and I went on holiday for a few weeks and was told no laptop :). But alas. For this post, I wanted to jump into something that has been very near and…
Read More
18 Nov 2018
By Devon

Office 365 DFIR

A planned methodology for developing and implementing a forensically sound incident response plan in Microsoft’s Office 365 cloud environment must be thoroughly researched and re-evaluated over time as the system evolves, new features are introduced, and older capabilities are deprecated. This presentation will walk through the numerous forensic, incident response, and evidentiary aspects of Office 365. The presentation is based on two years’ worth of collection of forensics and incident response data in Microsoft’s Office…
Read More