Brett's Blog
More Windows FE and triage notes (WindowsRipper?)
Matt Churchhill ( http://mattchurchill.net/2010/06/windowsripper/ ) has been doing some work to supercharge RegRipper . Take a look at his video and while watching, consider how this can affect your method to triage a computer when booted to WinFE... [youtube=http://www.youtube.com/watch?v=r4nBUXYGkBw&hl=en_US&fs=1&border=1]
This should be a neat webinar on Windows FE and Triage. https://www2.gotomeeting.com/register/892321554 Check the "Using WinFE" page for tips on using WinFE for not only triage/preview, but other ways to use the tool. Until I hear otherwise, I have found that X-Ways Forensics is the most complete forensic tool that can run on the Windows Fore...
Search Blog
Categories
Posts List
Tag Cloud
Virtualization
phishing
email
winfe
dfir
investigation
bitcoin
Registry Forensics
Hiding Behind the Keyboard
Windows Forensic Environment
training
wiretap
Placing the Suspect Behind the Keyboard
windows fe
writing
RegRipper
X-Ways Forensics Practitioner's Guide
Volume Shadow Copy
4cast
surveillance
case studies
Bitcoin Forensics
windows forensic environment
bitcoin forensics
investigations
gmail
tor browser
imaging
Jimmy Weg
forensics
X-Ways Forensics
University of Washington
book
privacy
Upcoming Events
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related
.
© 2018 Brett Shavers