Shadow Warriors - SANS Computer Forensics

12.07.2013 • Views

Share Embed Flag

Shadow Warriors - SANS Computer Forensics

Shadow Warriors - SANS Computer Forensics

DOWNLOAD ePAPER

computer.forensics.sans.org

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

START NOW

Current Investigation<br />

Methods

Building, Maturing & Rocking a Security Operations Center - SANS ...

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

exFAT History - SANS Computer Forensics

examples of recent apt persistence mechanisms - SANS Computer ...

Ovie Carroll - SANS Forensic Trends and Futures.pdf

Analysis & Correlation of Mac Logs - SANS

“ANN'S AURORA” - SANS Computer Forensics

Encryption v20.10 - SANS Computer Forensics

Tales from the Crypt - TrueCrypt Analysis - SANS

Digital Forensics for IaaS Cloud Computing - SANS Computer ...

Protecting Privileged Domain Accounts during Live Response

All the Gear..and No Idea.. - Scalable, fast - SANS

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Mark McKinnon RedWolf Computer Forensics Mark ... - SANS

Taking Registry Analysis to the Next Level - SANS Computer ...

Current Investigation Methods

Page 1 and 2: Shadow Warriors Lee Whitfield & Mar
Page 3 and 4: • 19+ years in IT Mark McKinnon
Page 5 and 6: What are Volume Shadow Copies?
Page 7 and 8: What Does This Mean?
Page 9 and 10: Shadow File Creation
Page 11 and 12: 16KB Block 16KB Block = Occupied 4K
Page 13: File Carve
Page 17 and 18: Data Blocks
Page 19 and 20: Contain: Index Blocks • volume lo
Page 21 and 22: Offset 128 of an index block 32 byt
Page 23 and 24: Bytes 24-27 contain one of the foll
Page 25: Practical Application
Page 28 and 29: 4520914944 - 12288 = 4520902656 (00
Page 31 and 32: Current Volume Complex File/Volume
Page 33 and 34: 00 00 00 C0 15 00 00 00 00 80 77 0D
Page 35: Excluded Files
Page 38 and 39: Demo
Page 40 and 41: Visit http://shadowanalyzer.com to