Category Archives: Investigations

No Drive Letter, No USB Evidence? Think Again!

Posted on 3 April 2020 by [email protected]

This post is about a question asked: If the user removes the drive letter to hide the presence of a mounted USB drive, could we still locate that drive in the Windows Registry? Short answer is, YES it will still … Continue reading →

Posted in DFIR, Forensics, Investigations, Windows | Tagged , , , , , , | Comments Off on No Drive Letter, No USB Evidence? Think Again!

Howto Setup and use the CuckooVM v2

Posted on 18 March 2020 by [email protected]

This post should cover the basics of how to import and run a basic analysis using the Cuckoo VM which could be found here. I’m referring to this VM as CuckooVM version 2, since if you’ve been following, you already … Continue reading →

Posted in DFIR, Forensics, Investigations, Malware, Virtualization | Tagged , , , , , , | Comments Off on Howto Setup and use the CuckooVM v2

Investigating Windows Systems (Book Review)

Posted on 1 January 2020 by [email protected]

Hello, We have a saying in Arabic “ان تأتي متآخراً، خيراً من أن لا تأتي أبدا” and in English “Better late, than never!”. This is my review to Harlan Carvey‘s last book titled “Investigating Windows Systems” which I should have … Continue reading →

Posted in Books, Forensics, Investigations, Windows | Tagged , , , , , , , , , | Comments Off on Investigating Windows Systems (Book Review)