Digital Forensic Survival Podcast

DFSP # 374 - SRUM 18.04.2023 15:08 ↓

This week I break down the Windows System Resource Usage Monitor from a DFIR point of view.

DFSP # 373 - Linux File Poisoning 11.04.2023 19:38 ↓

This week I cover some malware detection methods for Linux.

DFSP # 372 - Windows Processes 04.04.2023 25:46 ↓

This week I talk about different ways to approach windows process triage. There are so many processes, especially in enterprise environments, having a standard approach that is fast and effective is key for security incident response.

DFSP # 371 - AI with SUMURI 28.03.2023 26:17 ↓

This week Jason Roslewicz from SUMURI shares his insights about the impact of artificial intelligence and provides advice for navigating through changing times. 

DFSP # 370 - UserAssist 21.03.2023 18:31 ↓

This week is a Windows artifact breakdown on a common source of evidence.

DFSP # 369 - Linux Malware 14.03.2023 17:00 ↓

This week I cover malware on Linux file systems for new examiners.

DFSP # 368 - SVCHOST 07.03.2023 15:00 ↓

This week is a guide to understanding SVCHOST from a DFIR point of view. It is one of the most abused Windows processes, and having a firm working knowledge for investigations is essential.

DFSP # 367 - Shimcache Amcache 28.02.2023 15:03 ↓

This week is a Windows artifact breakdown on a common source of evidence.

DFSP # 366 - Linux File System 21.02.2023 15:41 ↓

This week I cover the Linux file system for new examiners.

DFSP # 365 - CVSS Triage 14.02.2023 16:08 ↓

This week I breakdown the elements within a standard CVSS report for fast triage application.

DFSP # 364 - Network Triage 07.02.2023 14:37 ↓

This week I talk about how to triage Windows events for network connection activity.

DFSP # 363 - RDP Forensics 31.01.2023 17:39 ↓

This week I talk about how to approach investigations involving remote desktop connections.

DFSP # 362 - Windows Core Processes 24.01.2023 19:18 ↓

This week I talk about Windows core processes from a DFIR point of view.

DFSP # 361 - Powershell Breakdown 17.01.2023 15:53 ↓

This week I talk about Powershell attack IOCs.

DFSP # 360 - Permitted Events 10.01.2023 13:11 ↓

This week I talk about how to triage Windows events for network connection activity.

DFSP # 359 - Career Checkpoint 03.01.2023 15:25 ↓

This week is my annual career assessment review - or, my guidelines of how to evaluate your past performance and your future goals.

DFSP # 358 - Listening Ports 27.12.2022 16:39 ↓

This week I talk about how to triage Windows events for network listening activity.

DFSP # 357 - EVTX Analysis 20.12.2022 15:28 ↓

This week I talk about an approach for reviewing Windows event logs.

DFSP # 356 - CMD Triage 13.12.2022 14:25 ↓

This week I talk about an approach for reviewing CMD syntax for findings.

DFSP # 355 - Network Triage 06.12.2022 14:51 ↓

This week I talk about essential network basics necessary for triage.

DFSP # 354 - Fast Triage 29.11.2022 16:59 ↓

This week I talk about Webshell forensics.

DFSP # 353 - Webshells 22.11.2022 15:59 ↓

This week I talk about Webshell forensics.

DFSP # 352 - Startup Locations 15.11.2022 10:32 ↓

This week I talk about Windows startup locations.

DFSP # 351 - Prefetch 08.11.2022 15:14 ↓

This week I talk about Windows Prefetch forensics.

DFSP # 350 - Linux Fileless Attacks 01.11.2022 16:06 ↓

This week I talk about fileless attacks Linux systems.