-
-
Recent Posts
-
Categories
- Academia (21)
- Android (1)
- Anti-Forensics (2)
- AntiX (4)
- Apache/Tomcat (8)
- Arabnix (6)
- BackTrack (5)
- Books (17)
- C5W (1)
- Challenges (5)
- Companies (16)
- Conferences (1)
- Cyber 5W (2)
- Database (23)
- Development (31)
- DFIR (14)
- Exploitation (8)
- File Systems (1)
- Firewalls (20)
- Footprinting (14)
- Forensics (22)
- Fun (28)
- GNU/Linux (101)
- HDFS (1)
- IDS/IPS (4)
- Investigations (13)
- Kernel (24)
- Life (161)
- Linux Security (68)
- Linux Services (37)
- Malware (9)
- Memory (1)
- Metasploit (6)
- Mobile (3)
- Networks (44)
- News (75)
- OSINT (6)
- Patch Management (5)
- PCI Compliance (8)
- PenTest (52)
- Poems (9)
- PortKnocking (10)
- Privacy (4)
- Publications (12)
- Real Madrid (17)
- Research (6)
- Security (84)
- Snippets (33)
- Social Engineering (4)
- Software/Tools (53)
- Sport (78)
- ThreatHunting (4)
- Unix (12)
- Virtualization (27)
- Vulnerability (7)
- Web Security (12)
- Webapp (4)
- WHM/Cpanel (6)
- Windows (19)
- Workshops (2)
- z0ne (16)
Archives
Tag Archives: USB
Investigating USB Drives using Mount Points Not Drive Letters
Yes, another excellent question came up by one of my students: If a user mounts the volume to a mount point, what artifacts could we find for the USB? Starting I think from Windows 8.1 or 10, a user could … Continue reading
Posted in DFIR, Forensics, Investigations, Windows
Tagged DFIR, Forensics, Investigations, registry, Registry Explorer, RegRipper, USB, Windows, Windows and tagged Computer Forensics
Comments Off on Investigating USB Drives using Mount Points Not Drive Letters
No Drive Letter, No USB Evidence? Think Again!
This post is about a question asked: If the user removes the drive letter to hide the presence of a mounted USB drive, could we still locate that drive in the Windows Registry? Short answer is, YES it will still … Continue reading
Posted in DFIR, Forensics, Investigations, Windows
Tagged Computer Forensics, DFIR, registry, Registry Explorer, RegRipper, USB, Windows
Comments Off on No Drive Letter, No USB Evidence? Think Again!
Disable Automount for SIFT
مشكلة بسيطة في إستعمال SANS Investigation Forensic Toolkit أو ما يسمى SIFT تكمن في عمل ربط mount للأجهزة الخارجية مثل USB بشكل تلقائي وهذا أمر سيء في مجال الـ Digital Forensics ولهذا لحل هذه المشكلة، كل ما عليك فعله هو: … Continue reading
Posted in Forensics, GNU/Linux
Tagged Automount, Computer Forensics, Digital Forensics, Disable, gconftool-2, mount, SANS, SANS Investigation Forensic Toolkit, SIFT, USB, VirtualBox, VMware
Comments Off on Disable Automount for SIFT
