03 Jul 2023
By Mary

InfoSec News Nuggets 07/03/2023

Tech firms sue Arkansas over social media age verification law  The technology industry isn't thrilled with Arkansas' law requiring social media age checks. NetChoice, a tech trade group that includes Google, Meta and TikTok, has sued the state of Arkansas over claimed US Constitution violations in the Social Media Safety Act. The measure allegedly treads on First Amendment free speech rights by making users hand over private data in order to access social networks. It also "seizes decision making"…
Read More
03 Jun 2023
By Devon

AboutDFIR Site Content Update – 06/03/2023

Tools & Artifacts - Windows - new entries added - Jumplist - Windows 10, RDP, Event Logs - Hidden Insights, VMware Workstation Memory Analysis, WMI Events, and another Windows Management Instrumentation (WMI) Tools & Artifacts - MacOS - new entry added - Tool List, mac_apt, APOLLO, and fseventd parser Tools & Artifacts - iOS - new entries added - iOS 15 Image (also added to Tool Testing) and Location & Device Data  Tools & Artifacts -…
Read More
20 May 2023
By Devon

AboutDFIR Site Content Update – 05/20/2023

Tools & Artifacts - Windows - new entry added - INetCache Tools & Artifacts - iOS - new entries added - IPA Files, Jailbreak (iOS 15), Anonymous Chat Rooms (Dating App), & iOS Shortcuts Tools & Artifacts - Android - new entries added - Jami and Gboard & Clipboard Training & Certifications - Cyber5W Courses & CCDFA Jobs - old entries cleaned up, new entries added - HM Revenue and Customs Stratford, Sirius XM, Arete,…
Read More
06 May 2023
By Devon

AboutDFIR Site Content Update 05/06/2023

Tools & Artifacts - Windows - new entries added - Adobe Acrobat Reader (link updated), Windows 11 GUID Partition Scheme (GPT), Windows Search Index, & Windows Artifacts General Reference Tools & Artifacts - iOS - new entry added - iPhone PINs & iOS Artifact Reference  Jobs - old entries cleaned up, new entries added - Flashpoint, Cellebrite, Raytheon, Nozomi Networks, Radware, Marriott, & Stripe Don't forget to submit any missing forensicators to our Forensicators of…
Read More
22 Apr 2023
By Devon

AboutDFIR Site Content Update 04/22/2023

Tools & Artifacts - Windows - new entries added - Memories & pCloud Tools & Artifacts - Android - new entry added - WiFi Annual Industry Reports - new entries added - PwC, Sophos Labs, & Unit 42 Jobs - old entries cleaned up, new entries added - SecureWorks, Varonis, Prudential Financial, Amazon, Kimberly Clark, Voya, Pacific Northwest National Lab, & Microsoft Forensicators of DFIR - cleaned up some dead links and added Derek Eiri…
Read More
08 Apr 2023
By Devon

AboutDFIR Site Content Update 04/08/2023

Tools & Artifacts - Windows - new entry added - Hayabusa (tool), BitTorrent, Avira Antivirus, GoToMeeting, AnyDesk Tools & Artifacts - Android - new entry added - SetupWizard Tools & Artifacts - iOS - new entry added - Locked Data Annual Industry Reports - new entries added - proofpoint, Arctic Wolf, Avast, BeyondTrust, Blackberry, Check Point, Cisco, Cisco, Veeam, IBM X-Force, Kaspersky, Mandiant, McAfee, Meta, ODNI Jobs - old entries cleaned up, new entries added…
Read More
25 Mar 2023
By Devon

AboutDFIR Site Content Update 03/25/2023

Tools & Artifacts - Windows - new entries added - BitComet & imo (Messenger) Tools & Artifacts - Linux - new entries added - Image Mounting & Memory Acquisition Tools & Artifacts - MacOS - new entry added - Safari Tools & Artifacts - iOS - new entry added - Deleted Messages Tool Testing - new entries added - Android 13 (x2) Annual Reports - new entries added - FBI Internet Crime Report & Red…
Read More
11 Mar 2023
By Devon

AboutDFIR Site Content Update 03/11/23

Tools & Artifacts - Windows - new entries added - Artifacts: AVG Antivirus, Windows Mail, USB Connection Times, Remote Access Software, 1Password, & Unigram | Tools: Dissect, Dumpit, & Timesketch Annual Reports - new entries added - RiskLens, Cyble, BD, TrendMicro, Recorded Future, Any.Run, SonicWall, IBM Security X-Force, CrowdStrike, & Datto Jobs - old entries cleaned up, new entries added - Progressive, Oracle, Warner Bros. Discovery, Antigen Security, Sirius XM, & Activision Forensic 4:cast awards…
Read More
28 Jan 2023
By Devon

AboutDFIR Site Content Update 01/28/2023

Tools & Artifacts - Windows - new entries added - LNK Files, Malwarebytes, PsExec, and Prefetch Tools & Artifacts - Android - new entries added - uTorrent and Garmin Connect Tools & Artifacts - File Systems - new entry added - $Security Jobs - old entries cleaned up, new entries added - Raytheon, Charles Schwab, Vanderbilt University, Cisco Talos, IHG Hotels & Resorts, Costco, Trustwave Government Solutions, Toyota Tsusho Systems US, Inc, and Columbia Sportswear…
Read More
31 Dec 2022
By Devon

AboutDFIR Site Content Update 12/31/22

Tools & Artifacts - Windows - new entry added - Event Logs (Cheat Sheet), Google Drive FS, File Explorer - Temporary Zip Folders, and Kaspersky Antivirus Tools & Artifacts - MacOS- new entry added - Logs - Unified Log Rolling Tools & Artifacts - Android - new entry added - Tusky Jobs - old entries cleaned up, new entries added - ADP, Pearson, Dell Secureworks, GEICO, United Airways, Xerox, Broadcom, and Malwarebytes AboutDFIR stickers are still…
Read More
17 Dec 2022
By Devon

AboutDFIR Site Content Update 12/17/22

Tools & Artifacts - Windows - new entry added - Defender Tools & Artifacts - iOS- new entries added - Dual SIM Phones, Photos.sqlite - ZINTERNALRESOURCE, Cache.db Tools & Artifacts - Android - new entries added - Sygic, Dual SIM Phones, Mastodon, Android 13 Image SANS Difference Makers Awards - Will update our page soon, but here's a recording of the Ceremony Jobs - old entries cleaned up, new entries added - Yahoo, Detego, and…
Read More
03 Dec 2022
By Devon

AboutDFIR Site Content Update 12/3/22

Tools & Artifacts - Windows - new entries added - MUICache and FeatureUsage/Taskbar Tools & Artifacts - iOS- new entry added - Facebook Messenger and AppIntent Jobs - old entries cleaned up, new entries added - CISA, Deloitte, Reddit, DigitalOcean, Durham Police Department, SEROCU, and Tracepoint Page of the Month - SANS Posters - new and updated posters have been added. (This has become more of a "Resource of the Month" so I'm going to…
Read More
22 Nov 2022
By Devon

AboutDFIR Site Content Update 11/22/22

Tools & Artifacts - Windows - new entries added - iTunes, Recent Items, and Email Forensics Tools & Artifacts - Linux - new entry added - Linux History File Timestamps Tools & Artifacts - Android - new entry added - Bumble Jobs - old entries cleaned up, new entries added - Peloton, Edgewater, and LiveNation Entertainment Leading right into U.S. Thanksgiving, I need to give a huge thank you to Alex (you may know him…
Read More
27 Sep 2022
By Mary

InfoSec News Nuggets 09/27/2022

Ukraine warns of 'massive cyberattacks' coming from Russia on critical infrastructure sites The Russian government is planning “massive cyberattacks” against Ukrainian critical infrastructure facilities to “increase the effect of missile strikes on electrical supply facilities,” the Ukrainian government said Monday. The Russians are also planning to “increase the intensity of the DDoS attacks on the critical infrastructure of Ukraine’s closest allies, primarily Poland and the Baltic state,” the country’s Defense Intelligence agency said in a statement posted…
Read More
24 Sep 2022
By Devon

AboutDFIR Site Content Update 9/24/22

Tools & Artifacts - Windows - new entries added - Microsoft Management Console MRU, File Carving, WordPad Recent Files, SDeleted Files, MRU, File Signature and Hash Analysis, Desktop Wallpaper, Windows Startup Programs, Microsoft Teams, and Email Forensics Tools & Artifacts - Android - new entry added - Forensic References Tools & Artifacts - iOS - new entry added - DFU: iPhone 8, 8 Plus, and iPhone X and Shared with You Syndication Photo Library Jobs…
Read More
27 Aug 2022
By Devon

AboutDFIR Site Content Update 8/27/22

The Forensic 4:cast Awards were announced. While we wait for the official posting, feel free to check my SANS DFIR Summit link collection for the results towards the bottom. I will add the official link to the Awards page on here as soon as I can.  Tools & Artifacts - Windows - new entries added - SQLite Databases, Recents Folder, Last Shutdown Jobs - old entries cleaned up, new entries added - Trellix, Bank of…
Read More
30 Jul 2022
By Devon

AboutDFIR Site Content Update 7/30/22

The site update is busy this week!  SANS Security Awareness Summit is next week Aug 3 & 4 and is still doing hybrid/virtual. This means you can still sign up to attend virtually for free today! The suggested attendees include CISOs, Security Engineers/Architects, Education/Training professionals, and Compliance/Legal/Auditing professionals. Topics include Phishing, Office365, Equifax, Metaverse, Psychology, Human Risk, and staying safe online. Tools & Artifacts - Windows - new entries added - Browser Downloads, Machine SID,…
Read More
16 Jul 2022
By Devon

AboutDFIR Site Content Update 7/16/22

Forensic 4:cast Award voting is now open!  Tools & Artifacts - Windows - new entries added - Event Tracing (ETW), Event Logs, Registry Hive Bins, ADS Zone.Identifier, Profiles, 360 Secure Browser, and Windows Management Instrumentation (WMI) Tools & Artifacts - Android - new entry added - Session Tools & Artifacts - iOS - new entry added - Speed/ZRTCLLOCATIONMO Jobs - old entries cleaned up, new entries added - ZeroFox, PWC, Gartner, Zoom, Cisco, Sophos, and Arctic…
Read More
02 Jul 2022
By Devon

AboutDFIR Site Content Update 7/2/22

Summer is ramping up and July seems to be a somewhat light month for updates. I'm hoping this means everyone is getting to enjoy some time to themselves doing whatever it is that you enjoy!  Featured Page of the Month - A link to "The Effect of Ransomware After The Investigation" authored by Devon. Read up on how ransomware can impact people and businesses. Tools & Artifacts - Windows - new entries added - Memory…
Read More
18 Jun 2022
By Devon

AboutDFIR Site Content Update 6/18/22

SANS held their first Ransomware Summit this week. If you missed it, I grabbed all the links I could and the sessions will be shared by SANS on Youtube soon. I especially liked Kunal Shandil's talk, "Multifaceted Extortion: Analysis of Data Exfiltration TTPs Used by Ransomware Threat Actors" and Jeffry Lang's break down "Kaseya Ransomware Reaction - Lessons Learned".  Tools & Artifacts - Windows - new entries added - Logfile, Tasks, Powershell Logs, VSS Carver,…
Read More
04 Jun 2022
By Devon

AboutDFIR Site Content Update 6/4/22

Surprise, not surprise, I posted the research!  Informally, I'd like to break down a little more what it could be useful for. App Timeline Provider logs mouse, keyboard, and audio activity for apps that are in focus on Windows 8+ machines. If you have mouse and keyboard activity within an app, you're validating that the window was "in focus" and that it was interacted with. If you have audio input and audio output, you can…
Read More
23 Apr 2022
By Devon

AboutDFIR Site Content Update 4/23/22

Big thing right up front - this is the last site update before the Forensic 4:Cast nominations close -  click here to nominate your favorite or most useful resources!  Annual Industry Reports- new entries added - RIA, Arctic Wolf, and Meta Jobs - new entries added - Raytheon Intelligence & Space, Zachary Piper Solutions, Cognizant, Kyndryl, and Center for Internet Security Tools & Artifacts - Windows - new entries added - Windows Registry, a graphing…
Read More
09 Apr 2022
By Devon

AboutDFIR Site Content Update 4/9/22

Keeping it short and sweet today. Hope you're all doing well! Annual Industry Reports- new entry added - 2022 Cyberthreat Defense Report & Cyber Security Breaches Survey 2022 Jobs - new entries added and old cleaned up - New positions include: Kroll, Peraton, Crowdstrike, Secureworks, and the Federal Public Defender's Office in Los Angeles Tools & Artifacts - Windows - new entries added - Pagefile URLs, Battery Levels, & PowerShell Scripts Tools & Artifacts -…
Read More
23 Sep 2021
By Mary

InfoSec News Nuggets 09/23/2021

Users increasingly willing to abandon digital platforms that demand personal info, stringent passwords and time-consuming forms A new survey from Ping Identity has found that more internet users are willing to stop using sites altogether if they find the experience cumbersome or invasive. The Ping Identity Consumer Survey queried more than 3,400 consumers across the US, UK, Germany, France and Australia about their experiences with signing up for websites and their attitudes toward online privacy. The survey found…
Read More