DailyDFIR

#DailyDFIR 249: Understanding file formats can be key in #DFIR. This is a nice examination of the JPEG file format including #Python code: https://t.co/6VZHogAtRr #DFIR

#DailyDFIR 248: @cScottVance has a series of posts exploring the "Tile" app. The app helps users track & find objects so it makes sense that there's a ton of interesting location data in it! 1 https://t.co/N1evt8eDYf 2 https://t.co/XXp27xuhaJ 3 https://t.co/FlLdMMw29N #DFIR

#DailyDFIR 248: @cScottVance has a series of posts exploring the "Tile" app. The app helps users track & find objects so it makes sense that there's a ton of interesting location data in it! 1 https://t.co/N1evt8eDYf 2 https://t.co/XXp27xuhaJ 3 https://t.co/FlLdMMw29N #DFIR

#DailyDFIR 248: @cScottVance has a series of posts exploring the "Tile" app. The app helps users track & find objects so it makes sense that there's a ton of interesting location data in it! 1 https://t.co/N1evt8eDYf 2 https://t.co/XXp27xuhaJ 3 https://t.co/FlLdMMw29N #DFIR

#DailyDFIR 247: ICYMI I've found a way to extract embedded timestamps from #TikTok IDs (). This means we can tell when a TikTok was posted (or an account was created) just from the URL! Works even if video is deleted or private. https://t.co/uNqtmNyqY4 #DFIR #OSINT https://t.co/JJ8CjFo5DE

@GPurohit4 @HeatherMahalik Past ones have been posted at https://t.co/YnavMAzgcH I believe this one should be up there as well eventually.

#DailyDFIR 246: Unfurl can expand some short-links. A common question is how? It uses an allowlist of domains & queries them for the 301 Location header. It doesn't reach out to the target sites. #opsec 25 short-link domains supported; full list: https://t.co/dKD0zI9k3X #DFIR https://t.co/J5QOw4biHd

#DailyDFIR 246: Unfurl can expand some short-links. A common question is how? It uses an allowlist of domains & queries them for the 301 Location header. It doesn't reach out to the target sites. #opsec 25 short-link domains supported; full list: https://t.co/dKD0zI9k3X #DFIR https://t.co/J5QOw4biHd

#DailyDFIR 182: A new version of Unfurl is here! Features: New command-line tool: unfurl_cli.py Now on PyPI - easier install with "pip install dfir-unfurl" More details: https://t.co/nkUR4JOXvu #DFIR https://t.co/NSCJWWNRSo

#DailyDFIR 183: Want to parse a string or some hex you think might be a protobuf? The new Unfurl CLI like the web app can parse more than URLs. It runs all the other parsers on each value. In this example an integer inside the protobuf was parsed as a timestamp . #DFIR https://t.co/oFcL9oC9q0

#DailyDFIR 184: Have a number you suspect is a timestamp? Pass it to Unfurl! It will convert if it's a "plausible" value (year 2015-2025) for any of these timestamp types: Unix epoch micro/milli/centi/seconds Webkit Windows FileTime/DateTime Mac/Cocoa #DFIR https://t.co/h5elrmsiS9

#DailyDFIR 185: New input/output modes for Unfurl! If you pass Unfurl a file path instead of a URL it will open that file and parse each line in it. Using -o option will save output to a CSV file (leave off to send output to screen). Thanks @B1N2H3X for the request! #DFIR https://t.co/JQnlbrrf5b

#DailyDFIR 187: There's a new Plaso release! Changes in v20200630: - New parsers for Apple TCC.db & Google glog - Status view shows more info - New unattended mode for when Plaso is being run by another tool - Better timezone handling Full details: https://t.co/kn445IlmZn #DFIR

#DailyDFIR 188: Geolocating an IP address sounds like a fun analysis step but it typically isn't very accurate (esp for mobile devices). Expect to get general area at best not precise location. @nixintel & @MwOsint did some experiments: https://t.co/udF9nTu7VA #DFIR #OSINT

#DailyDFIR 189: Looking for a place to ask a #DFIR question (besides Twitter)? Check out the Digital Forensics Discord Server (run by @bunsofwrath12)! It has dozens of channels for different #DFIR subtopics and hundreds of active users. to join: https://t.co/rPBbuQqFwq

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 191: There's more to browser history than visited URLs. @cScottVance from @MagnetForensics talks about some #Safari preferences to be aware of when investigating on #macOS. https://t.co/aWO6Y0hJjv #DFIR

#DailyDFIR 192: OSDFCon is a unique conference focused on open source #DFIR software. Attendees get to pick what talks they'd like to see but today's the last day to vote on the #OSDFCon agenda: https://t.co/bT93fYP4Q8

#DailyDFIR 193: Lots of good mobile #DFIR info in this. I like this version much better for a digital copy rather than panning around a giant poster. https://t.co/BlhTus4BTB

#DailyDFIR 194: @bigt252002 shares a list of 10 books that will help increase your #DFIR knowledge: https://t.co/rrZM8KvGIX I've read most of these and agree that they are good to have on hard; some technical bits might get a bit dated but core ideas and principles remain.

#DailyDFIR 195: Post from @anthomsec & @x04steve on using automated scanning to track threat actors: https://t.co/85BEGrPKmO It's a good reminder that defense doesn't have to be solely reactive. Having good intel on attacker infrastructure can speed your response considerably.

#DailyDFIR 196: Did you know you can tell when a file attachment was uploaded to #Discord from the URL? Find out how (and much more) when I present on Unfurl at the @DFIRSummit in two days! Agenda: https://t.co/wLC6EYJYgM #DFIR @SANSInstitute #Python #Infosec https://t.co/4j66bcd39a

#DailyDFIR 196: Did you know you can tell when a file attachment was uploaded to #Discord from the URL? Find out how (and much more) when I present on Unfurl at the @DFIRSummit in two days! Agenda: https://t.co/wLC6EYJYgM #DFIR @SANSInstitute #Python #Infosec https://t.co/4j66bcd39a

#DailyDFIR 197: Want to see what information may be hiding in a URL? Come see my presentation on my open source tool Unfurl tomorrow at the @SANSInstitute #DFIRSummit! Agenda: https://t.co/wLC6EYJYgM #DFIR #Python #OpenSource https://t.co/aESkBRbyJs

#DailyDFIR 198: Thanks to everyone who watched my presentation on Unfurl at the #DFIRSummit today! Use Unfurl online: https://t.co/ZfRisFEVnM Get the code: https://t.co/ASz314wAeh It's been a great first day and I'm looking forward to more talks tomorrow! #DFIR @DFIRSummit https://t.co/tfX4wjctk7

#DailyDFIR 198: Thanks to everyone who watched my presentation on Unfurl at the #DFIRSummit today! Use Unfurl online: https://t.co/ZfRisFEVnM Get the code: https://t.co/ASz314wAeh It's been a great first day and I'm looking forward to more talks tomorrow! #DFIR @DFIRSummit https://t.co/tfX4wjctk7

#DailyDFIR 200: In my presentation on Unfurl at the #DFIRSummit I talked (a lot) about extracting things from URLs. I also covered some of my general investigative principles: 1 Use What You Have 2 Automate 3 Recognize Dead Ends 4 Details Matter 5 Context Matters #DFIR https://t.co/1dakNza2H1

#DailyDFIR 201: In my Unfurl talk I covered pulling server creation times (& other timestamps ) from #Discord URLs. With a little bit of #OSINT you can find the name of the @discord server too! Search the ID on https://t.co/yR7IUIXbFg: https://t.co/0O9Ye0BuAk #DFIR https://t.co/deQIpxnxoc