Daily Blog #504: Forensic Lunch Test Kitchen 10/11/18

Новости информационной безопасности




Daily Blog #504: Forensic Lunch Test Kitchen 10/11/18

Hello Reader,
          Tonight we had what I think is a very exciting broadcast of the Forensic Lunch. When discussing on twitter whether or not a ObjectID would be created when a file is accessed over a network share DR Joe Sylve (watch the video to see why i capitalized doctor) hypothesized that it would not, while I pontificated that it would. It turns out ... it does! We then extracted and encoded the local objectid database (/$extend/$objid:$o) and parsed it to find out which systems had which dad.

Here is what we learned:

You can watch the video here:

Дата: 2018-10-12 04:11:26

Источник: http://www.hecfblog.com/2018/10/daily-blog-504-forensic-lunch-test.html

daily blog,forensic lunch,objectid,test kitchen,unc