Join me in Lisbon in 3 weeks for lots of @sansforensics #FOR500 Windows forensics fun. I’ve discovered some fun new things about USB connection artifacts that I’ll be sharing first at this event, so you’ll want to be around for all that!
Sign up here: https://www.sans.org/u/1yrB
@USBTypeSTeve when I walked into day one of teaching #FOR500 yesterday, I automatically assumed it was rum. I was disappointed 🤣
It is, unfortunately, water
Check out the new @sansinstitute #DFIR #FOR500 poster of Windows Artifacts at https://lnkd.in/gtkz69Dz
Chad Tilbury and I have been super busy with major updates for windows 11, cloud artifacts, USB artifact updates for SCSI devices, browser updates, app execution artifact updates & more!
The “Evidence of...” categories were originally created by SANS Digital Forensics and Incidence Response faculty for the SANS course FOR500: Windows Forensic Analysis. The categories map a specific artifact to the analysis questions that it will help to answer. Use this poster as a cheat-sheet to help you remember where you can discover key Windows artifacts for computer intrusion, intellectual property theft, and other common cyber crime investigations.
The “Evidence of...” categories were originally created by SANS Digital Forensics and Incidence Response faculty for the SANS course FOR500: Windows Forensic Analysis. The categories map a specific artifact to the analysis questions that it will help to answer. Use this poster as a cheat-sheet to help you remember where you can discover key Windows artifacts for computer intrusion, intellectual property theft, and other common cyber crime investigations.
Kathryn Hedley
harryr
Kevin Pagano - Stark 4N6 