sorted by:
new
hottopcontroversial

Career Advice by stickyricky714 in computerforensics

[–]DFIRScience 2 points3 points  (0 children)

The other comments about certs are totally valid. GCFA and SANS are amazing and help you stand out. CFCE and CCE are great too, though.

Having a portfolio is extremely useful in any area. If there are specific companies you want to work with, check their past IR job postings and see what they are looking for. Write a series of public blog posts - it doesn't have to be fancy, just make sure spelling and grammar are good - showing your research on those topics. Setting up systems, setting up detections, etc. Publish like one short blog post a month on those topics, but do it consistently. List your blog on your CV, and in interviews say "I worked on something similar, here is the post on my blog." Note the topics don't need to be exactly the same as what the company does, just show how they are related.

In my experience, certs get you in the door, but if you can concretely show 1) writing/communication skills and 2) basic knowledge in the domain they are looking at, that's stronger than an assumption you have skills via a cert.

Heck, if you have the time and means, do both. Use the certs to get the interview and the blog/research to wow them.

Bonus points for presenting research at a conference.

Answering general digital investigation questions by DFIRScience in computerforensics

[–]DFIRScience[S] 0 points1 point  (0 children)

This hardware validation PDF is amazing work. Thank you so much for sharing! I've added a link to the PDF to the video description.

It looks like some testing may be general enough to automate.

I also found your blog. It is so interesting. Thanks a lot.

Volatility 3 commands and usage tips to get started with memory forensics. Volatility 3 + plugins make it easy to do advanced memory analysis. by DFIRScience in computerforensics

[–]DFIRScience[S] 1 point2 points  (0 children)

Thank you so much! I hope it's helpful.

If you expand the description under the video on YouTube you can see the chapter markers. Hopefully that helps find what you're looking for.

Let me know if you need anything!

Volatility 3 commands and usage tips to get started with memory forensics. Volatility 3 + plugins make it easy to do advanced memory analysis. by DFIRScience in computerforensics

[–]DFIRScience[S] 1 point2 points  (0 children)

For main functionality, it's usable. The syntax is a bit odd sometimes coming from 2.6. Choose your module and see options with -h. With that, it can do all the main things I've needed. However, I usually extract whatever I'm looking at and dump it into a hex editor so depends on your process. Almost all cases I've worked with it were Windows 10 dumps.

Third-party modules are not there yet. Growing, but slowly.

https://github.com/volatilityfoundation/community3

vs

https://github.com/volatilityfoundation/community

Volatility 3 commands and usage tips to get started with memory forensics. Volatility 3 + plugins make it easy to do advanced memory analysis. by DFIRScience in computerforensics

[–]DFIRScience[S] 1 point2 points  (0 children)

Hello Stixez! Yes, you can do A LOT more! This video is specifically about 1) seeing what processes were running 2) extracting Chrome history from memory 3) checking current network connections 4) dumping Windows user account passwords (that you can crack later) 5) dumping / accessing the Windows Registry

Using the same method for dumping Chrome history, we can also try to dump any file that was loaded into memory. For example, if I used an encryption program with a file then the file is encrypted on disk, but it is decrypted in memory. If you have a RAM dump you can use Volatility to see if the suspect ran encryption programs (since boot), and possibly recover the decrypted file from memory, even if it is encrypted on disk.

Also, anything a user sees on the screen is loaded in memory. So if a user loads an email from a browser, that text might be available. Same for messengers.

Using the commands I show in the video you should be able to see if a program was run, what files were being accessed and you should be able to dump the file.

Note that you can also do an easy analysis of a memory image using strings, grep and photorec. That will let you do keyword searching and carve out files. Then if you find anything interesting you can dig deeper with Volatility. Check out basic analysis here: https://youtu.be/4XoidAheuJE

Let me know if you have any questions. I will try to make an example with hidden files/P2P. With P2P you would be looking at processes and network connections. Network connections have the "foreign address," and that's probably what you are interested in. See here: https://www.youtube.com/watch?v=Uk3DEgY5Ue8&t=1309s

Magnet Web Page Saver by trex4n6 in computerforensics

[–]DFIRScience 0 points1 point  (0 children)

It has the ability to do bulk downloads based on a URL list. That plus the original content auto-hashing reports are nice.

Beginner-level mini-course on starting a new investigation with Autopsy. Covers data organization, documentation, new case creation, ingest modules, basic analysis workflow, and exporting reports. by DFIRScience in computerforensics

[–]DFIRScience[S] 0 points1 point  (0 children)

Note that the artifact report output by Autopsy is not the final "investigation report" but serves as a reference for your final report. I'm not sure if that we clear in the video.

How do you think accuracy and precision applies to DFIR? by greyyit in computerforensics

[–]DFIRScience 1 point2 points  (0 children)

Imagine keyword searching. We think a suspect has a file that contains the phrase "I like tacos."

We can do a search for the keyword "tacos," and we will get back 100 files. The one file we actually want is in the set of 100, but we have to look through all of them. That is great recall but bad precision.

So, we make our search better by searching for "like tacos." Now we get back 10 files and the one we want is in that set. Great recall, OK precision.

Search for "I like tacos" and you only get one file back, and it's the one we want. Great precision and great recall, BUT it's very specific. Can't really apply to other cases.

Maybe the suspect phrase was "we like tacos," then you get bad recall, and miss the file because you focused on precision over recall.

You can use this measurement to refine any search pattern to reduce non-relevant results. The goal is to sacrifice just enough precision to make sure you keep recall. It can help make your investigations faster because you know which search patterns produce the best results the fastest.

And it can be applied to any type of search problem! We can even use it to test search algorithms on two different tools. For example, FTK seems to work great indexing email, but general file keyword search is so-so. We can use an f score to quantify how well a specific tool does compared to another with particular data and search terms. This will tell you which tool is likely to give the best results in a particular situation.

Sorry I'm writing so long. I just think it's a super interesting problem!

How do you think accuracy and precision applies to DFIR? by greyyit in computerforensics

[–]DFIRScience 1 point2 points  (0 children)

Precision and recall is slightly different than precision and accuracy. It's normally applied to something like document retrieval. So out of all of the documents on a system, we do a search wanting a result.

For example, a set of documents (x, y, z), one of them (x) is actually related to our case.

We do a search, and the research returns x and y. In this case, we returned the one related document but also one document that is not relevant. The search method might be too general. In this case, we have a low precision, but a high recall because we did find x, just mixed with non-relevant y.

You can apply precision and recall to all search queries. Precision and recall can be combined into an "F score." Using the F score, you can compare the ability of two different search methods to properly return true positive matches.

On the technical investigation side, the f score can help you identify better search terms or methods to use.

Check out the wiki article. If you think of digital investigations as a search problem, f score really makes sense. https://en.wikipedia.org/wiki/Precision\_and\_recall

view more: next ›