Pages

▼
Friday, February 24, 2017

Onion Peeler: Batch Tor Lookup Program

›
Logs, Logs, Logs. I see, IPs. When reviewing log files for suspect activity it can be helpful to look up information related to IP addresses...
1 comment:
Monday, February 20, 2017

When Windows Lies

›
Wait, What? Windows lies? I believe so... I worked a case where I checked the Windows Install date and it was a couple days before we rece...
10 comments:
Wednesday, October 5, 2016

Quicklook thumbnails.data parser

›
Earlier this year at the request of a reader I wrote a tool to parse the Quicklook thumbnails index.sqlite file. This sqlite database sto...
Thursday, September 22, 2016

Mac Live Imaging: Functionality Versus Speed

›
My series on imaging a Mac would not be complete without covering how to do a live acquisition of a Mac. Now that FileVault2 appears to be t...
2 comments:
Saturday, September 3, 2016

Cookie Cruncher Update, Timelines, Chrome Parser and more

›
I just wanted to pass on that I had a chance to update my Google Analytic Cookie Cruncher to support Firefox up to version 48. I can't ...
Tuesday, July 19, 2016

Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux

›
Before I continue my series on how to image Mac systems, I wanted to cover how to mount and work with FileVault2 encrypted Mac images. By ...
4 comments:
Wednesday, July 6, 2016

How to image a Mac using Single User Mode

›
This is the second post in my series on different ways to image a Mac. My first post was on how to image a Mac with a bootable Linux di...
4 comments: