int for(ensic){blog;}

The Digital Forensic Research Workshop 2007 (DFRWS 2007) will be held in Pittsburgh, PA, US from August 13 to 15, 2007. The workshop will be hosted by CERT/CC. The Call for Papers is now open and closes on April 9, 2007.

By Andreas Schuster at 10/30/2006, 06:40 AM | Permalink

Harlan Carvey posted some comments and an article regarding the analysis of pool allocations. One of the remaining taks is to identify "interesting" pool tags. I already wrote about network activity to illustrate the top-down approach. Now here's a tool to aid in bottom-up.

By Andreas Schuster at 10/24/2006, 06:00 PM | Permalink

Today IMF 2006 starts - and I'm excited to announce the public release of a new tool named PoolFinder. PoolFinder accompanies my paper Pool Allocations as an Information Source in Windows Memory Forensics which I will present at IMF.

By Andreas Schuster at 10/18/2006, 08:00 AM | Permalink

Not everybody feels at home at a command prompt. Therefore Richard McQuown has created a frontend for PTFinder.

By Andreas Schuster at 10/11/2006, 06:00 PM | Permalink

Microsoft pushed out Release Candidate 2 of Vista. Among the host of new features in Vista there is a new file format for event logs. This article is the first in a series which shall help you to accustom yourself to the new format.

By Andreas Schuster at 10/10/2006, 06:00 PM | Permalink

In an earlier post I refered to a paper by Hany Farid which analyzes quantization tables found in JPEG file headers. As I'd like to introduce his method in my lab I'm taking a closer look.

By Andreas Schuster at 10/09/2006, 06:00 PM | Permalink

I've just learned that PTFinder will be packaged in Debian format and added to the next release of grml Linux live CD shortly. Two other programs will be added, too: ssdeep by Jesse Kornblum and the library and tools for the Advanced Forensics File Format by Simson Garfinkel. Thanks to the grml project!

By Andreas Schuster at 10/07/2006, 11:05 PM | Permalink

The paper Digital Image Ballistics from JPEG Quantization by Hany Farid describes how digital stills can be attributed to camera makes due to certain differences in the implementation of JPEG compression.

By Andreas Schuster at 10/05/2006, 06:00 PM | Permalink