int for(ensic){blog;}

The substitution mechanism allows to separate content from structure. Variable data will be moved into a separate table, the "Substitution Array". Placeholders within the XML stream, the substitution system tokens, will point to the proper element.

By Andreas Schuster at 07/31/2007, 09:00 PM | Permalink

Parsing clear text can be a tedious piece of work, especially in the case of XML, which is known for its low entropy. Under the premise that XML messages are frequently re-read, the conversion of certain language elements into "tokens" can save a significant amount of computational power and also cuts down on the requirements for storage space.

By Andreas Schuster at 07/31/2007, 04:00 PM | Permalink

Guidance Software and Access Data have updated some of their products during the last few days.

By Andreas Schuster at 07/30/2007, 05:00 PM | Permalink

By far the largest part of an event record consists of a complex binary XML structure. I'm going to explain its internals in a series of postings. I'm starting with an overview of the XML schema.

By Andreas Schuster at 07/30/2007, 04:00 PM | Permalink

I'm excited to release the first version of a template for the 010 Editor which parses the outer structure of a Vista event log file. By "outer structure" I refer to the structures described earlier in this blog, from the file level down to the single record. However, the template can not yet decode the binary XML inside of an event record - and provably never will. For this task I will provide a more complex tool in a few weeks.

By Andreas Schuster at 07/17/2007, 04:00 PM | Permalink

ACM SIGOPS is soliciting the submission of papers for its Operating Systems Review. This special issue will be dedicated to computer forensics, especially with the upcoming arts of live forensics and the analysis of volatile data.

The call for paper closes on December 1st, 2007.

(via Bradley Schatz)

By Andreas Schuster at 07/16/2007, 07:40 PM | Permalink

This article documents the structure of a single event record within a Vista Event Log (.evtx) file. The event records go one by one, following the chunk header.

By Andreas Schuster at 07/11/2007, 04:00 PM | Permalink

Each event log file contains one or many so-called "chunks", which store the event records. During operation, only the current chunk of an event log file is mapped into memory.

By Andreas Schuster at 07/10/2007, 04:00 PM | Permalink

This article documents the Evtx file header. The file header provides some overall information about a Vista event log file.

By Andreas Schuster at 07/09/2007, 04:00 PM | Permalink

"Chopstick" published two articles about CarvFS in his blog Chirashi Security.

By Andreas Schuster at 07/08/2007, 09:00 PM | Permalink

The Association of Chief Police Officers in co-operation with 7Safe released an updated edition of their Good Practice Guide for Computer-Based Electronic Evidence.

By Andreas Schuster at 07/06/2007, 07:00 PM | Permalink

Since version 2.3 the shared libraries and utility programs which implement the Advanced Forensic Format (AFF), are also available for the Microsoft Windows platform.

By Andreas Schuster at 07/06/2007, 04:00 PM | Permalink

NIST has just released their test reports for GuidanceSoftware's FastBloc FE (with USB and FireWire interface) and the Tableau T5 (also with USB and FireWire interface).

By Andreas Schuster at 07/05/2007, 04:00 PM | Permalink

The FIRST Conference 2008 will be held in Vancouver, Canada, from June 22-27, 2008. The Call for Papers is open until November 15, 2007.

By Andreas Schuster at 07/02/2007, 04:00 PM | Permalink