Sniper Forensics V2.0 Target Acquisition - SANS - SANS Institute

More documents

Recommendations

Info

Analysis BAM! Anti-<strong>Forensics</strong> Schmanti-Schmorensics 32324 FILE 348 1 0x38 4 1 0x0010 96 0 0x0000 0x0000 M: Mon Jun 23 12:28:52 2003 Z A: Tue Sep 28 21:34:57 2010 Z C: Tue Sep 28 00:18:58 2010 Z B: Mon Jun 23 12:28:52 2003 Z Modified birth date 0x0030 112 0 0x0000 0x0000 FN: inetmgr.exe Parent Ref: 29 Parent Seq: 1 M: Wed Jun 2 17:51:20 2010 Z A: Wed Jun 2 17:51:20 2010 Z C: Wed Jun 2 17:51:20 2010 Z B: Wed Jun 2 17:51:20 2010 Z Accurate birth date 0x0080 72 1 0x0000 0x0000 Copyright Trustwave 2010 Confidential
Analysis Analyzing RAM dumps is a great way to see what is going on RIGHT NOW! Memoryze Established network connection to CHINA? Not good! * There are detailed instructions on how to use Memoryze on The Digital Standard Three part series on Analyzing RAM Dumps Copyright Trustwave 2010 Confidential
Page 1 and 2: Sniper Forensics V2.0 Target Acquis
Page 3 and 4: Thank You Dan Christensen! Copyrigh
Page 5 and 6: TheDigitalStandard.Blogspot.com Cop
Page 7 and 8: The Evolution of: Sniper Forensics
Page 9 and 10: Sniper Forensics V3.0: Black Ops U
Page 11 and 12: - Jibran Ilyas - Senior Security Co
Page 13 and 14: and slaps him right in the face! He
Page 15 and 16: Target Acquisition What do I d
Page 17 and 18: Target Acquisition How do I snipe i
Page 19 and 20: Target Acquisition FTK Imager v3.00
Page 21 and 22: Target Acquisition Rinse, Repeat, R
Page 23 and 24: Trigger Squeeze RegRipper, or TSK)
Page 25 and 26: Trigger Squeeze Super Timelines (Th
Page 27 and 28: Trigger Squeeze Rip the $MFT I use
Page 29 and 30: Rounds Down Range Know how to stack
Page 31: Analysis String search in timeline
Page 35 and 36: Analysis Copyright Trustwave 2010
Page 37 and 38: Copyright Trustwave 2010 Confidenti
Page 39 and 40: Copyright Trustwave 2010 Confidenti
Page 41 and 42: While the $S_I can be accessed by b
Page 43 and 44: All Your Config Files are Belong to
Page 49 and 50: Seriously, at Least Try! Copyright
Page 51 and 52: Seriously, at Least Try! TypedURLs
Page 53 and 54: Seriously, at Least Try! Not shown:
Page 55 and 56: Conclusion Take good notes Good c

Sniper Forensics V2.0 Target Acquisition - SANS - SANS Institute

Create successful ePaper yourself

Delete template?

Save as template?