Sometimes URL structures aren't mysterious just annoying to read all crammed on one line. #DailyDFIR 19: Unfurl can expand a #JSON string to make the key/value pairs easier to see. https://t.co/qmTG1KZR2W #DFIR https://t.co/7aQZT1Sgew

Looking for some Saturday #DFIR reading? How about on private browsing forensics? #DailyDFIR 18: tl;dr: Most browsers are pretty good (except IE) & RAM is your best chance of recovering anything. https://t.co/i6tB8pdEqM by @GraemeHorsman https://t.co/hVqrmfsa2p by Joe Walsh

Digital Forensics & Incident Response Summit & Training 2021 | SANS Institute

Yesterday Microsoft launched its Chromium-based Edge. #DailyDFIR 16: The new #MicrosoftEdge looks a lot like #Chrome from a #DFIR perspective. Hindsight can parse it . I took a quick look and not much has changed from my look at the dev version: https://t.co/aJI7dqvdAl

#DailyDFIR 15: Ever seen a long Facebook search URL and wonder what's in it? FB search filters use JSON and Base64 both of which Unfurl can parse: https://t.co/cMSgi4V5Rc There's a ton of good info and discussion on @djnemec's gist: https://t.co/mL1CYw3CoR #DFIR #OSINT

Malicious or fraudulent URLs often have inconsistencies that Unfurl can help reveal. #DailyDFIR 14: @PhishLabs had a write-up about Office365 app phishing (https://t.co/F2PwnHP7zy). Check out the Unfurled URL in the image; see anything strange? #DFIR https://t.co/gB9WvPD1rk

#DailyDFIR 13: Unfurl update! Improvements around domain parsing. Added: Support for internationalized domain names Extract subdomains/TLD Show scheme user/password and/or port (if provided) Thanks to @djnemec for the PR! https://t.co/ldvc8sBlOD #DFIR https://t.co/ByEyAVruBz

Mastodon is an open source distributed Twitter-like service. Each independent instance has its own domain. #DailyDFIR 12: #Mastodon has IDs similar to Twitter & we can extract post timestamps from them. https://t.co/MbUFzImWOw Thanks to @sim4n6 for the Unfurl PR! #DFIR

I've been showing Unfurl for URLs but it can also parse other things. #DailyDFIR 11: Unfurl will try to interpret a numberas whatever timestamp makes most sense. Supports: Unix epoch micro/milli/seconds WebKit Mac Abs Time & more! https://t.co/efiU0XBqEG #DFIR

#DailyDFIR 10: ULID (Universally Unique Lexicographically Sortable Identifier) is another -like timestamp. Example: 01ARZ3NDEKTSV4RRFFQ69G5FAV Features: Sortable 26 chars vs UUID's 36 Larger timestamp range https://t.co/B90zLEgMb7 https://t.co/OBvszWO2RK #DFIR https://t.co/Z49zMuhmCG

UUIDv1 has a timestamp & node ID which can be the MAC address of the machine it was generated on (or random; it depends ). #DailyDFIR 8: Unfurl can extract the timestamp & node ID from a UUIDv1 and look up the vendor if it's a real MAC address. https://t.co/k4jM1cBJUL #DFIR https://t.co/KarLXl0mmy

Since a lot of uh interesting files get passed around on chat apps we can use snowflake timestamps to add a layer to our analysis. #DailyDFIR 6: Knowing when a file was uploaded to #Discord can be useful in both malware and insider investigations. #DFIR cc: @ItsReallyNick https://t.co/l6C15G8zn4

#Discord is a chat app but it can send files as attachments too. #DailyDFIR 5: We can tell when a file was uploaded to @discordapp from its URL by looking at the timestamp in the File ID (2nd snowflake ): https://t.co/ZqtBb3etB7 #DFIR https://t.co/P79YtVpObo

This one is also about @discordapp but with a #OSINT twist. #DailyDFIR 4: We can search for the server ID from yesterday's #Discord URL on https://t.co/6H1k3pCHGH and find the message was from @bunsofwrath12's Digital Forensics Discord server: https://t.co/6fy6gvixCk #DFIR https://t.co/SZu083Sz9P

Continuing with snowflakes @discordapp uses a variation of Twitter's for IDs. #DailyDFIR 3: A #Discord message URL has 3 snowflakes/timestamps. We can extract when the server channel and message were created . https://t.co/q0DHrA8btf https://t.co/vltPkLVWJT #DFIR https://t.co/UE4a5kYzqJ

Since I'm doing this on @twitter let's start with tweet URLs. #DailyDFIR 2: Each tweet has a unique ID called a snowflake and contains a timestamp. We can extract this timestamp to find when the tweet was sent: https://t.co/gLnZb5hlrK https://t.co/d9IfBHlktq #DFIR https://t.co/F6DbBtkQR7

I've set a goal in 2020 to post a tweet every day about something #DFIR-related. Each month will have a theme with the tweets featuring tips examples and links. Follow me here (and at https://t.co/rSnsnYWaUs) for your #DailyDFIR! https://t.co/ls97iJRqWW