Another Forensics Blog

RDP is a common way for an attacker to move laterally within an environment. Forensically, when an attacker uses RDP we can use artifacts ...

As a follow up to my SANS webcast , I wanted to post detailed instructions on how to use KAPE to collect triage data and generate a mini-t...

This is the second part in my series on Finding and Decoding Malicious PowerShell Scripts. My first blog post walked through how to find ...

As a follow up to my post on how to mount AFPS images on Windows, I wanted to post about how to mount an APFS image on a Linux system. If y...

APFS is the new file system for Mac OS, and so far, many forensic suites are playing catch up as far as support goes. As such, workarounds m...

PowerShell. It's everywhere. I've started coming across more and more malicious PowerShell scripts. Why do attackers love us...