DFIR Science

Starting with Velociraptor Incident Response

Velociraptor IR (Incident Response) is an open-source endpoint visibility tool. You can monitor many clients across networks, conduct hunts on all clients, or define subsets of relevant systems based on ...

[+] Show More

Now Playing

Starting with Velociraptor Incident Response

Velociraptor IR (Incident Response) is an open-source endpoint...

[+] Show More

Now Playing

Digital Forensics and the Military - Interview with Andrew Lister

Win Prizes! Take the quiz here: https://forms.gle/vAhy7NFfei5ZVuLy8...

Now Playing

Forensic 4:Cast Awards ✨ The real award is DFriends we made along the way ✨

Come hang out with the nominees for the Forensic 4:Cast "Best DFIR Show...

Now Playing

Forensics: What data can you find in RAM?

To determine if you need to collect Random Access Memory on-scene, it...

To determine if you need to collect Random Access Memory on-scene, it is useful to know what kinda of investigation-relevant data is often available in RAM.

Random Access Memory forensics starts ...

[+] Show More

Now Playing

Windows and Linux Authentication Bypass with AIM

This video is not sponsored by Arsenal Recon. Arsenal Image Mounter 3.9...

This video is not sponsored by Arsenal Recon. Arsenal Image Mounter 3.9 is out and has a lot of new features. You need to check out three features: Windows authentication ...

[+] Show More

Now Playing

What is Random Access Memory?

Random Access Memory forensics starts with acquiring RAM from a live...

Random Access Memory forensics starts with acquiring RAM from a live (turned on) system. There are several ways to collect the contents of RAM from a computer. Almost all of ...

[+] Show More

Now Playing

Vote for DFIR Science!

DFIR Science was nominated for the Forensic 4:cast awards under "DFIR...

Now Playing

🇺🇳 Africa DFIR CTF 2022 Award Ceremony 🎉

Huge DFIR stream with a lot of Q&A. Check out the chapter times...

Now Playing

Fast password cracking - Hashcat wordlists from RAM

Password cracking often takes a long time. Brute force is normally your...

Password cracking often takes a long time. Brute force is normally your last option. But before that, a wordlist usually helps guess the password faster.

Popular wordlists like Rockyou are good ...

[+] Show More

Now Playing

Linux LVM Ext4 Support in Windows with Arsenal Image Mounter

Previously we showed how to access a Linux Logical Volume Manager...

Previously we showed how to access a Linux Logical Volume Manager partition inside a forensic disk image. We were looking for a way to access the LVM partition in Windows, ...

[+] Show More

Now Playing

Mounting Linux Logical Volumes in Forensic Disk Images

Linux supports Logical Volume Management, which assists in managing...

Linux supports Logical Volume Management, which assists in managing partition features such as resizing and encryption. However, many forensic tools cannot directly access data on an LVM partition.

Thank you to ...

[+] Show More

Now Playing

Linux Forensics with Linux - CTF Walkthrough

Cyber5W released a mini Linux Forensics capture the flag (CTF) as part...

Cyber5W released a mini Linux Forensics capture the flag (CTF) as part of the Magnet User Summit 2022. [https://lfmus22.cyber5w.net/] It is open until the end of the year. And while ...

[+] Show More