« February 2010 | Main | April 2010 »

Vista event log

Evtx Parser Version 1.0.4

Version 1.0.4 of my Microsoft Vista and Windows 2008 Event Log parser is now available for download. This version adds data integrity checking and fixes some errors.

(more...)

By Andreas Schuster at 03/25/2010, 04:00 PM |

Vista event log

A non-empty NullType

The separation of content and structure along with the substitution mechanism is a core concept of the event log. The XML template contains placeholders, that are filled in from the associated slots of the record's substitution array. Whenever the slot contains a NullType "value", the system suppresses the placeholder and its containing XML element. These NullType slots do not contain any data. At least that's what I thought for too long.

(more...)

By Andreas Schuster at 03/11/2010, 04:00 PM |

File Systems

Tutorial on File System Analysis

I'm excited to announce that my proposed tutorial on file system analysis was accepted for the 22nd Annual FIRST Conference. I'm going to explain how to proceed when the usual tools like EnCase, FTK, and X-Ways Forensics are unable to parse a file system.

(more...)

By Andreas Schuster at 03/01/2010, 04:00 PM |