Digital Forensic Survival Podcast

This week I'm going to cover an important Windows event that provides valuable information about authentication attempts and potential security breaches. The event may be used to identify compromised ...

7 Nov 202315min

In Linux and Unix-based operating systems, the "root" account is the superuser or administrator account with the highest level of privileges. It has complete control over the system and can perform an...

31 Okt 202318min

This week we are taking a bit of a deep dive into an advanced attack technique to accomplish remote execution called "fetch and execute." While there are different methods to accomplish the sort of th...

24 Okt 202315min

This week I am going to focus on a specific remote execution technique that you may see in the wild. Remote execution is important for incident response investigations but also for file use and knowle...

17 Okt 202314min

Finding and analyzing failed logons sometimes is just as important as finding suspicious, actual logon activity. Like anything, context is important. Old logon records offer an opportunity to identify...

10 Okt 202313min

This week I will discuss the use of the OODA loop and JOHARI window in security incident response investigations. These two frameworks are designed to help organizations quickly and effectively respon...

3 Okt 202316min

This week I'm talking about the linux file system from the point of view of a forensic analyst. In general, it's a good idea to have a solid working knowledge of the linux file system so you understan...

26 Sep 202320min

This week I will talk about investigating data spill cases involving exposed URLs. This is a typical privacy investigation many incident response teams handle and I thought it would be useful to go ov...

19 Sep 202318min