From my home to yours, I give my optimism for our world will become a better place after this pandemic is controlled. We have grown closer together as a community, with neighbors and with family. I hope you and yours will be well through this time.
Useful updated content from DFIR Training that you can use today
Free online training in the form of webinars, courses, and virtual conferences are listed at https://www.dfir.training/webinars-listings . This list is ever-growing as I find the events posted online. There is no better time to take advantage of online training than now. To give advance warning of "I told you so" after we eventually and surely will back in our offices at some point, anyone who did not take advantage of the freely shared DFIR information during this time will regret it. Those who took advantage will be very happy that they did. Just saying....
There is no cost to list a free event, so if you see one, have one, or know of one, send it to me and I'll add it. All I need is the URL.
Foxton Forensics' Browser History Examiner
You can check out my review of BHE here https://www.dfir.training/dfir-training-blog/foxton-forensics-browser-history-examiner. If you submitted an entry, I have drawn a winner ( Robert Rhyne ). For everyone else, stand by for the next giveaway!
If you are short on time, the meat-n-potatoes of the review is that BHE works, it's fast, I like it, and I will be using it. Oh yeah, there is a remote collection ability that you can do with BHE, which fits well in our current world's situation.
But take a look at the review anyway and be sure to check out Foxton Forensics .
Free Downloads at DFIR Training!
Some very useful downloads are being added that can be put to use right away. No registration, no user account, no spam email, no anything needed to download.
First up are the Regular Expression (regex) downloads . The Internet is rife with regex spread out across websites much like dumping a can of tomato sauce on pizza dough, as in, no order of where everything is! I've made a page and uploaded a few text files and have been given some as well to upload. One thing about regular expressions is that (1) you can write your own, (2) yours may look different than mine, and (3) some work better than others. With that, if you see a regex already uploaded but yours is different, I encourage you to have it added because as you know, some work well, some don't work as well, and some tools will work with some or give errors. Send me your regex!
The next popular download updates are Keyword Search Lists . These lists are pre-made text files that you can either modify are import directly into your forensic tool for searching. One thing that I have been asked is OPSEC concerning keyword search lists. Here is my opinion:
(1) It is just a list of words.
(2) A list can be made with an Internet search, like "drug terms" and copied into a text file.
(3) Even if a criminal used the same lists to make sure none of the words were on their computer, it would be virtually impossible for the criminal to selectively wipe every file with every term on the list.
(4) It is impossible to commit crimes without using the terminology used in planning or committing crimes.
The benefit of everyone having access to these lists is that everyone becomes more effective in finding the bad stuff in exams. So, if you have a list, I encourage sharing with the community because a keyword list saves time in searching and creating the same list that everyone else is using. Send me your list! https://www.dfir.training/contact-dfir-training
DFIR Training Events
Classroom events have been canceled worldwide, and this was expected. When checking the DFIR Training event list, be aware that the courses may or may not happen if it is not online, depending upon the safety of having live classes in the near or anticipated future. However, the events will be listed until otherwise confirmed to be canceled or changed. Personally, I would expect at some point that we will be back to attending live training events, but with some changes. Perhaps a drastically reduced limit of attendees, protective masks, no more buffets or snack tables, etc... Or maybe DFIR training remains online. I am curious as to where we end up with training events, both classroom and online.
Did you catch the latest Windows Forensics Environment (WinFE) release?
If not, you can check out the details here: https://brettshavers.com/brett-s-blog/entry/mini-winfe-10-and-winfe-10-updated . Along with Colin Ramsden's WinFE 10 update, where his build is tailored to boot (and image!) ARM devices, the other newest update is the alternative build method using PE Bakery. PE Bakery is an easier method of building WinFE and now includes Colin Ramsden's updated write protect tool using an improved and updated build project with PE Bakery. Curated WinFE build and updates are here: https://winfe.wordpress.com/ . WinFE is free since you build it yourself.
If you want documented training in WinFE, Patreon subscribers at https://www.patreon.com/DFIRTraining have access to the only online WinFE course , the only WinFE course available outside of law enforcement , and the only course created by a founding developer of the WinFE project . Subscribers also get the ebook of the Ultimate Cheats! Windows Forensic Environment and have access to the slidedecks used in the course. Better yet, until further notice, subscriptions are over 60% off at $50 .
Oh yeah, about that X-Ways Forensics Practitioner's Guide Second Edition.
It took nearly a year to get the publishing rights released, but I finally have it done. Eric Z and I will be working to get the updated X-Ways Forensics book out this year. If you didn't hear, Syngress isn't publishing new editions (or new DFIR books at all!) anymore due to a new business model. After hearing that bad news, I have been asking for the rights back so that we can do a new edition. Now I have it in my hand, figuratively speaking. Be on the lookout for the next edition of the X-Ways Forensics Practitioner's Guide! You can keep up with the progress of the book at: https://xwaysforensics.wordpress.com/
Here's to the second edition!
Your time to shine is now
Given the abrupt move from the physical office to our home offices (whether that be your living room, kitchen, den, garage, or bedroom), many workers of the world were caught completely off guard and unprepared to work from home. Those in the computer field didn't skip a beat. We, especially those in DFIR, have perfected working from anywhere on the planet, to include while traveling in the air, one the land, and over the sea. Much of the rest of the world is not as fortunate and this is where you can shine. First, get your family online , and I don't mean social media. Connect them to the world of video conferencing, in whichever app you see best. And your neighbors . Make sure they have connections to the world and their work. And then businesses . There are businesses that can operate somewhat online but never had the need. Now is the time to help them too.
I am not advocating that you go door-to-door to make this happen. A phone is all that is needed to walk a non-tech person into the video conferencing world. Are your local schools having a difficult time planning for online teaching? You are a pro in this field and if I guess right, you had more than a few video meetings just this past week alone.
So shine and help whoever you can to connect to the world. You might be able to save someone's job. Or someone's business. Or even someone's life. Shine on.