New Home For My Blog
Just a quick blog post for the reasoning behind moving my blog. There were several reasons for the move, the main one being the relocation to the techanarchy.net domain. The techanarchy blog
Chip_DFIR
I am Chip (Aka Dale) and I work in the DFIR arena for a large UK CERT. Happily married to my wife Colleen I enjoy rugby , F1 and anything computer related has always peaked my interest!
Timestamp Anomalies - $MFT
Going through my SANS 508 material I decided to have a closer look at some of the material on the Master File Table ($MFT) in the NTFS file system and how the analysis
Timeline Creation - Part 2 (Super Timeline)
As promised in my previous blog post I would be moving on to create a Super Timeline and my reasons for carrying this out after the filesystem timeline is purely down to the
Timeline Creation - Part 1 (Filesystem Timeline)
As I mentioned previously I am currently studying for my GCFA (GIAC Certified Forensic Analyst) exam and as part of my revision I am completing the exercises in the workbook. One area I
Grep and icat
Just a very brief blog post regarding the power of grep and icat in relation to forensic images. I am currently revising for my GCFA certification and as part of this revision was
Chrome Cache - Where's the stash (Part 2)
In Part 1 of this blog I mentioned the metadata regarding one of the separate files contained within the deleted cache. I stated that I would further explain what is contained within that