Канал: 13Cubed

New Course! Investigating Linux Devices

New Course! Investigating Linux Devices

The Weird Windows Feature You've Never Heard Of

The Weird Windows Feature You've Never Heard Of

The Ultimate Guide to Arsenal Image Mounter

The Ultimate Guide to Arsenal Image Mounter

Where's the 4624? - Logon Events vs. Account Logons

Where's the 4624? - Logon Events vs. Account Logons

RDP Authentication vs. Authorization

RDP Authentication vs. Authorization

2024 Investigating Windows Courses

2024 Investigating Windows Courses

Hyper-V Memory Forensics - MemProcFS to the Rescue!

Hyper-V Memory Forensics - MemProcFS to the Rescue!

An Important Change to ShellBags - Windows 11 2023 Update!

An Important Change to ShellBags - Windows 11 2023 Update!

VMware Memory Forensics - Don't Miss This Important Detail!

VMware Memory Forensics - Don't Miss This Important Detail!

Old School MS-DOS Commands for DFIR

Old School MS-DOS Commands for DFIR

Detecting PsExec Usage

Detecting PsExec Usage

A File's Life - File Deletion and Recovery

A File's Life - File Deletion and Recovery

Two Thumbs Up - Thumbnail Forensics

Two Thumbs Up - Thumbnail Forensics

Interview with Lesley Carhart (hacks4pancakes)

Interview with Lesley Carhart (hacks4pancakes)

It's About Time - Timestamp Changes in Windows 11

It's About Time - Timestamp Changes in Windows 11

EZ Tools Manuals Interview with Andrew Rathbun

EZ Tools Manuals Interview with Andrew Rathbun

A New Program Execution Artifact - Windows 11 22H2 Update!

A New Program Execution Artifact - Windows 11 22H2 Update!

The Dissect Effect - An Open Source IR Framework

The Dissect Effect - An Open Source IR Framework

Let's Talk About MUICache

Let's Talk About MUICache

How Many Timestamps??? #Shorts

How Many Timestamps??? #Shorts

Impacket Impediments - Finding Evil in Event Logs

Impacket Impediments - Finding Evil in Event Logs

What's on My DFIR Box?

What's on My DFIR Box?

MemProcFS - This Changes Everything

MemProcFS - This Changes Everything

Anatomy of an NTFS FILE Record - Windows File System Forensics

Anatomy of an NTFS FILE Record - Windows File System Forensics

The Case of the Disappearing Scheduled Task

The Case of the Disappearing Scheduled Task

Windows Hibernation Files - A Look Back in Time

Windows Hibernation Files - A Look Back in Time

Let's Talk About NTFS Index Attributes

Let's Talk About NTFS Index Attributes

Puzzling RDP Cache - Putting the Pieces Together

Puzzling RDP Cache - Putting the Pieces Together

Accessing Mounted Images from WSL #Shorts

Accessing Mounted Images from WSL #Shorts

Detecting NTDS.DIT Theft - ESENT Event Logs

Detecting NTDS.DIT Theft - ESENT Event Logs

EventTranscript.db Deep Dive - New Windows Forensic Artifact!

EventTranscript.db Deep Dive - New Windows Forensic Artifact!

Event Log Chainsaw Massacre - Powerful Threat Detection

Event Log Chainsaw Massacre - Powerful Threat Detection

User Access Logging (UAL) Forensics

User Access Logging (UAL) Forensics

RDP Hashes - Event ID 1029 Explained

RDP Hashes - Event ID 1029 Explained

Let's Talk About Shimcache - The Most Misunderstood Artifact

Let's Talk About Shimcache - The Most Misunderstood Artifact

Introduction to MFTECmd - NTFS MFT and Journal Forensics

Introduction to MFTECmd - NTFS MFT and Journal Forensics

Dumping Processes with Volatility 3

Dumping Processes with Volatility 3

The ABCs of WMI - Finding Evil in Plain Sight

The ABCs of WMI - Finding Evil in Plain Sight

Profiling Network Activity with Volatility 3 - GeoIP from Memory

Profiling Network Activity with Volatility 3 - GeoIP from Memory

Hashcat for Forensics - How Did They Get In?

Hashcat for Forensics - How Did They Get In?

Plaso and WSL 2 - The WSL Adventures Continue...

Plaso and WSL 2 - The WSL Adventures Continue...

Volatility 3 and WSL 2 - Linux DFIR Tools in Windows?

Volatility 3 and WSL 2 - Linux DFIR Tools in Windows?

Getting Started with Plaso and Log2Timeline - Forensic Timeline Creation

Getting Started with Plaso and Log2Timeline - Forensic Timeline Creation

Introduction to Cyber Triage - Fast Forensics for Incident Response

Introduction to Cyber Triage - Fast Forensics for Incident Response

Linux Memory Forensics - Memory Capture and Analysis

Linux Memory Forensics - Memory Capture and Analysis

What's In .DS Store for You? - macOS Forensics

What's In .DS Store for You? - macOS Forensics

Prefetch Deep Dive

Prefetch Deep Dive

Channel Update - April 2020

Channel Update - April 2020

Introduction to iLEAPP - iOS Forensics Made Easy

Introduction to iLEAPP - iOS Forensics Made Easy

Mini Memory CTF - A Memory Forensics Challenge

Mini Memory CTF - A Memory Forensics Challenge

Extracting Prefetch from Memory

Extracting Prefetch from Memory

CVEs in Windows Event Logs? What You Need to Know

CVEs in Windows Event Logs? What You Need to Know

Email Header Analysis and Forensic Investigation

Email Header Analysis and Forensic Investigation

Introduction to Kansa - PowerShell-based Incident Response

Introduction to Kansa - PowerShell-based Incident Response

First Look at Volatility 3 Public Beta

First Look at Volatility 3 Public Beta

Finding Evil with YARA

Finding Evil with YARA

Linux Forensics! First Look at usbrip

Linux Forensics! First Look at usbrip

Memory Forensics Baselines

Memory Forensics Baselines

Introduction to Arsenal Image Mounter

Introduction to Arsenal Image Mounter

NTFS Journal Forensics

NTFS Journal Forensics

Introduction to EvtxECmd

Introduction to EvtxECmd

First Look at Windows Terminal

First Look at Windows Terminal

Detecting Persistence in Memory

Detecting Persistence in Memory

DFIR Home Labs - Storage Review

DFIR Home Labs - Storage Review

Mounting VHD/VHDX Images in Linux

Mounting VHD/VHDX Images in Linux

The Volume Shadow Knows

The Volume Shadow Knows

Free Tools From Magnet Forensics

Free Tools From Magnet Forensics

DFIR Home Labs

DFIR Home Labs

EventFinder2 Demo

EventFinder2 Demo

Introduction to KAPE

Introduction to KAPE

Your Signature Is a JAR

Your Signature Is a JAR

Visual Analysis with ProcDOT

Visual Analysis with ProcDOT

Pulling Threads

Pulling Threads

Triage Image Creation

Triage Image Creation

Juicy PDFs

Juicy PDFs

Cooking with CyberChef

Cooking with CyberChef

Payload Distribution Format

Payload Distribution Format

Persistence Mechanisms

Persistence Mechanisms

Introduction to Hashcat - Part II

Introduction to Hashcat - Part II

Secret Office 365 Activities API

Secret Office 365 Activities API

RDP Event Log Forensics

RDP Event Log Forensics

Some Assembly Required

Some Assembly Required

Windows Process Genealogy - Update

Windows Process Genealogy - Update

Windows Process Genealogy

Windows Process Genealogy

Event Log Forensics with Log Parser

Event Log Forensics with Log Parser

Introduction to USB Detective

Introduction to USB Detective

Volatility Profiles and Windows 10

Volatility Profiles and Windows 10

RDP Cache Forensics

RDP Cache Forensics

Recycle Bin Forensics

Recycle Bin Forensics

ShellBag Forensics

ShellBag Forensics

Channel Update and Survey

Channel Update and Survey

Introduction to Plaso Heimdall

Introduction to Plaso Heimdall

LNK Files and Jump Lists

LNK Files and Jump Lists

Introduction to Redline - Update

Introduction to Redline - Update

Introduction to Redline

Introduction to Redline

CCleaner v5.33 Malware (Supply Chain Attack)

CCleaner v5.33 Malware (Supply Chain Attack)

Windows NTFS Index Attributes ($I30 Files)

Windows NTFS Index Attributes ($I30 Files)

Windows Memory Analysis

Windows Memory Analysis

Windows MACB Timestamps (NTFS Forensics)

Windows MACB Timestamps (NTFS Forensics)

Windows SRUM Forensics

Windows SRUM Forensics

Introduction to Hashcat

Introduction to Hashcat

Windows Application Compatibility Forensics

Windows Application Compatibility Forensics

Introduction to Windows Forensics

Introduction to Windows Forensics

Introduction to Memory Forensics

Introduction to Memory Forensics

Browse Volume Shadow Copies on a Live Windows System

Browse Volume Shadow Copies on a Live Windows System

Windows Incident Response Practice Lab

Windows Incident Response Practice Lab

Parse Email Headers and Files for GeoIP Location Data

Parse Email Headers and Files for GeoIP Location Data