DFIR, cyber warfare, digital profiling, CEO & Founder PLAINBIT Co., Ltd. https://xitter.gq/t.co/7APlFR4HQN
Seongnam-si, Republic of Korea
Joined February 2010
- Tweets2.3K
- Following714
- Followers1K
- Likes14
Malicious PyPI packages that steal cryptocurrency wallet information, blog.plainbit.co.kr/pypi-pac…
1
162
DFC2022 has started this year as well. Let's go solve the problem! dfchallenge.org/
DFC(Digital Forensics Challenge)2021 started. Great experience, valuable time and improvement of my level dfchallenge.org/ #DFC2021
Digital Forensics Challenge 2020 is finally OPEN! dfchallenge.org/ #DFC2020
Check the following registry key for the folder id of Windows Timeline.
NTUSER.DAT\Software\Microsoft\Office\<version>\Common\Identity\Identities
2
Why does winprefetchview still parse format version 26? Please update to support Windows 10 (format version 30). PECmd is great, but it's hard to lose the GUI's comfort. github.com/libyal/libscca/bl…
The boot prefetch is no longer visible in Windows 10. It seems to be the effect of fast startup. Now let's look at bootckcl.etl.
The Superfetch service is no longer visible. This service has been replaced by SysMain. The EnablePrefetcher registry value is no longer meaningful.
1
3
Using MITRE ATT&CK for Forensics: WMI Event Subscription (T1084), cyberforensicator.com/2019/0…
JK Kim retweeted
Registry Explorer v1.5 coming soon! New stuff includes exporting selected bytes from hex viewer to a file, control updates, some fixes here and there, and showing all non-associated deleted values in a hive #DFIR
