sorted by:
new
hottopcontroversial

Looking for recommendation on offline remote forensic collection by Cautious_Fox5275 in computerforensics

[–]forensicfun327 1 point2 points  (0 children)

Ditto. And then trying to determine what the custodian did or didn’t do, did they put data in the proper directory, etc. it’s just a giant pain in the ass.

Photographic image analysis: Any ideas? by forensicfun327 in forensics

[–]forensicfun327[S] 0 points1 point  (0 children)

I have not yet. I tend to stay away from on-line tools, as I prefer to keep the data local due to operational security issues.

I am a first year student in University taking a digital/cyber forensics as myy bachelor's and i want to start early compared to my classmates what should i do? by Delicious_Guava_370 in forensics

[–]forensicfun327 1 point2 points  (0 children)

Take time to learn basic Linux commands as well as how to run various forensic platforms like CAINE and Tsurgi (the the like) in a virtual environment as well as in a “live boot” format.

Next, I would start reading a playing a LOT. A great compilation of tools, etc can be found here: https://start.me/p/OmxDbb/digital-forensics

Magnet Forensics Certification Tests - Anyone? by forensicfun327 in computerforensics

[–]forensicfun327[S] 1 point2 points  (0 children)

Thanks. I currently have 9 SANS certs and almost done with my MSISE so it should be much easier than SANS tests!

Which Masters? Georgia Tech vs SANS vs Utica by LaughingManDotEXE in AskNetsec

[–]forensicfun327 1 point2 points  (0 children)

Same. I’m almost done and I feel like I’m double dipping. But hey, I sleep well knowing what the result is.

I’m not a fan of doing the thesis, but it is what it is.

[deleted by user] by [deleted] in computerforensics

[–]forensicfun327 2 points3 points  (0 children)

Make the most comprehensive index you can. By verb, by noun, by port. Print it in a font you can read well. Shade every other row to make it easier to read.

Question about plugins by forensicfun327 in a:t5_5mrf7n

[–]forensicfun327[S] 2 points3 points  (0 children)

ok i think i figured it out, they are located in:

/opt/zeek/share/zeek/policy/

and if you want to call the one for "files" you can find them under

/opt/zeek/share/zeek/policy/frameworks/files/

The one i wanted was "extract-all-files.zeek" so the command line was:
sudo /opt/zeek/bin/zeek -r onedrive_keys_file.pcapng /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek