 |
 |
|
August 02, 2004FirstOnScene, the 10-second Forensic Data Gathering Toolbmonday announced that he has released a script called FirstOnScene which basically will take a working forensic snapshot of a Windows system within 10 seconds. Basically he has written a visual basic script wrapper of some of the more common tools from guys like SysInternals and Foundstone. I haven't actually tried it yet, but will definitely follow his progress and see where this tool ends up. It sounds quite interesting. I have something similar that I use, but is based on a bootable live CD. Why a separate bootable CD you ask? Because Windows has a major inherit problem from a forensic analysis point of view. By simply running some of the standard auditing tools you trample on critical evidence as it relates to cache, swap and data access. (This is an issue with the OS, not the tools) Timelines get tainted in an unfortunate way if you do to much on a Windows system for to long after you enter the system. Normally, unless I HAVE to get a map of volitile memory, I just pull the plug, mirror the drive and work on the data on an isolated forensic machine. But thats just me. Anyways, looks like bmonday has been busy. If you got the time, check of FirstOnScene and see if it meets your needs. Posted by SilverStr at August 2, 2004 12:34 AM | TrackBack |
 
My 5 Favorite Books
Writing Secure Code
Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind
My 5 Favorite Papers
Smashing the Stack
Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides
Archives
January 2007
December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 |
|
