Manipulating WFP and Residual IOCs

I just posted on the SpiderLabs Anterior blog about manipulating WFP and what IOC that would leave behind. Check it out!

Pauldotcom Inverview

If you missed my interview on Pauldotcom last night, you can still watch it on their website.

Interview on Pauldotcom

Sweet! I will be on Pauldotcom tomorrow night talking about Sniper Forensics! Check it!

Context, Context, Context

Check out the SpiderLabs blog, "Anterior" for the latest Sniper Forensics post.

SecTor 2011 Huge Success

I am back from Toronto, and once again Brian Bourne, Renu Bourne, Bruce Cowper and the rest of the SecTor folks out on one of the best security conferences anywhere in the world.

A special thanks to Melanie Wallis for handling the logistics for all of the speakers!

If you have not been to SecTor in the past, you are seriously missing out. The talks get better year after year, and the crowd continues to grow. This year Brian said they had over 1100 attendees, which is fastasic!

Also, Grayson Lenik, Jibran Ilyas, and I conducted a one day Forensics training seminar that went beautifully, and was very well recived.

Great job again to everyone at Black Arts LTD for making SecTor 2011 a huge success!

The Great Northern Invasion

So I am heading to Canada twice this month to speak at two different security conferences.

On October 17th, I am presenting a day of Law Enforcement training in Toronto at SecTor followed on the 18th by the debut of Sniper Foreniscs v3.0: Hunt.



Then, on October 25th, I am speaking at SecureTech Canada where I am sitting on a panel discussing Cyber Extortion and Protecting Critical Data.




I am really looking forward to a pile of poutine...and maybe a Keith's!

If anyone is going to SecTor, I will be at Joe Bidali's right across the street from the hotel on most nights. See you there eh!

Log2Timeline Intall Guide

Some folks have indicated that they cannot find this. According to Kristinn, it's in the "Install" documentation.

+ ---------------------------------------------------------------------------------------------------------------------
+ WINDOWS
+ ---------------------------------------------------------------------------------------------------------------------
This has been tested on a Windows XP sp3 machine (32 bit), and Win7 64 bit machine.

Download and install ActiveState Perl
Open command prompt and run the following commands (install dependencies):

ppm install datetime
ppm install win32::api
ppm install date::manip
ppm install xml::libxml
ppm install carp::assert
ppm install digest::crc
ppm install data::hexify
ppm install image::exiftool
ppm install file::mork
ppm install datetime::format::strptime
ppm install parse::win32registry
ppm install html::scrubber

Download the latest source code for log2timeline
Download two additional libraries:

"http://search.cpan.org/CPAN/authors/id/B/BD/BDFOY/Mac-PropertyList-1.33.tar.gz"
"http://search.cpan.org/CPAN/authors/id/S/SI/SIXTEASE/XML-Entities-1.0000.tar.gz"

Uncompress

Inside the XML-Entities:
Copy the content of the lib/XML folder to c:/perl/lib/XML/

Inside the Mac-Propertylist:
Create the directory c:/perl/lib/Mac
Copy the content of the lib/* to c:/perl/lib/Mac

Inside the log2timeline directory
Delete the file lib/Log2t/input/pcap.pm
Copy the content of the lib/Parse/* to c:/perl/lib/Parse/
Copy the content of the folder lib/Log2t to c:/perl/lib/Log2t/*
Copy lib/Log2Timeline.pm to c:/perl/lib/
Copy log2timeline to c:/perl/bin/log2timeline.pl
Copy l2t_process to c:/perl/bin/l2t_process.pl
Copy timescanner to c:/perl/bin/timescanner.pl


Test and hope the best... ;)