DailyDFIR

#DailyDFIR 171: @iamevltwin has (many!) updates to knowledgeC modules in APOLLO: https://t.co/v8zaUC3HcL https://t.co/myaQ8hv83g knowledgeC is a really interesting resource worth checking out if you are examining an iOS or macOS device! #DFIR

#DailyDFIR 172: Metaspike has a couple nice posts on the different kinds of encoded timestamps you may find in email messages: https://t.co/WHpFqzoBN8 https://t.co/nqecrYwZQa I don't examine emails very often but I do like finding timestamps encoded in new places! #DFIR

#DailyDFIR 173: Few references materials in #DFIR have remained as useful as @carrier4n6's "File System Forensic Analysis" (from 2005!): https://t.co/SyYKR2Vdqz This deep-dive into file systems is quite handy to have nearby (either for a case or for CTF trivia @bethlogic). https://t.co/II3Zawv8lH

#DailyDFIR 174: @SwiftForensics wrote a good post on Screentime Notifications: https://t.co/u74yxWda2m Besides the content I like the post's format. It's relatively short & focused on a single artifact. Reminds me of 4n6k's "Forensics Quickies" from back in the day. #DFIR

#DailyDFIR 175: @hackerfactor has a detailed post examining a plethora of approaches to detect timestamp manipulation in photos: https://t.co/2PeKWKNJ9S It is similar to #DFIR cases where the system clock was changed; you can use other factors to tell something is off.

#DailyDFIR 176: @13CubedDFIR has a video explaining basics about .DS_Store files on #macOS and how to get value from them in #DFIR investigations: https://t.co/dUvkr6tvrH by @13CubedDFIR DSStoreParser Tool https://t.co/4Kx2eMJys6 by @nicoleibrahim

#DailyDFIR 177: More fun with .DS_Store files: @JPoForenso on using .DS_Store files to find references to deleted files: https://t.co/luIC3GVKaq & https://t.co/0wIg3moWLd Interesting way to leverage exposed .DS_Store files: https://t.co/KfgDuc5P2n #DFIR #macOS

#DailyDFIR 178: I'm a big proponent of using visualizations to help with analysis & I love seeing how others make use of them. @Forensicator4 wrote a post about exploring the visualization options in #Python & #Pandas with a #DFIR spin: https://t.co/00RmMH0FCx #DFIR

#DailyDFIR 180: @DianaInitiative CFP is open! This year the slogan is "Breaking Boundaries Byte by Byte" and the (virtual) conference is August 21-22. #DFIR https://t.co/Pwg0brwdHP

#DailyDFIR 181: It's almost July and that means more great #DFIR events! Check out the list @DfirDiva put together with a focus on beginners: https://t.co/GZzarsNS81 It includes the @DFIRSummit which I'll be speaking at about Unfurl!

#DailyDFIR 182: A new version of Unfurl is here! Features: New command-line tool: unfurl_cli.py Now on PyPI - easier install with "pip install dfir-unfurl" More details: https://t.co/nkUR4JOXvu #DFIR https://t.co/NSCJWWNRSo

#DailyDFIR 183: Want to parse a string or some hex you think might be a protobuf? The new Unfurl CLI like the web app can parse more than URLs. It runs all the other parsers on each value. In this example an integer inside the protobuf was parsed as a timestamp . #DFIR https://t.co/oFcL9oC9q0

#DailyDFIR 184: Have a number you suspect is a timestamp? Pass it to Unfurl! It will convert if it's a "plausible" value (year 2015-2025) for any of these timestamp types: Unix epoch micro/milli/centi/seconds Webkit Windows FileTime/DateTime Mac/Cocoa #DFIR https://t.co/h5elrmsiS9

#DailyDFIR 185: New input/output modes for Unfurl! If you pass Unfurl a file path instead of a URL it will open that file and parse each line in it. Using -o option will save output to a CSV file (leave off to send output to screen). Thanks @B1N2H3X for the request! #DFIR https://t.co/JQnlbrrf5b

#DailyDFIR 187: There's a new Plaso release! Changes in v20200630: - New parsers for Apple TCC.db & Google glog - Status view shows more info - New unattended mode for when Plaso is being run by another tool - Better timezone handling Full details: https://t.co/kn445IlmZn #DFIR

#DailyDFIR 188: Geolocating an IP address sounds like a fun analysis step but it typically isn't very accurate (esp for mobile devices). Expect to get general area at best not precise location. @nixintel & @MwOsint did some experiments: https://t.co/udF9nTu7VA #DFIR #OSINT

#DailyDFIR 189: Looking for a place to ask a #DFIR question (besides Twitter)? Check out the Digital Forensics Discord Server (run by @bunsofwrath12)! It has dozens of channels for different #DFIR subtopics and hundreds of active users. to join: https://t.co/rPBbuQqFwq

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 190: https://t.co/yYRNtjkQuf is an interesting tool for #OSINT (Google search as if you were in a different place). It's also useful to test Unfurl; for example I added the "uule" param long ago but hadn't seen it used before: https://t.co/yEwy6l1txt #DFIR https://t.co/V5rgP4HXqu

#DailyDFIR 191: There's more to browser history than visited URLs. @cScottVance from @MagnetForensics talks about some #Safari preferences to be aware of when investigating on #macOS. https://t.co/aWO6Y0hJjv #DFIR

#DailyDFIR 192: OSDFCon is a unique conference focused on open source #DFIR software. Attendees get to pick what talks they'd like to see but today's the last day to vote on the #OSDFCon agenda: https://t.co/bT93fYP4Q8

#DailyDFIR 193: Lots of good mobile #DFIR info in this. I like this version much better for a digital copy rather than panning around a giant poster. https://t.co/BlhTus4BTB

#DailyDFIR 194: @bigt252002 shares a list of 10 books that will help increase your #DFIR knowledge: https://t.co/rrZM8KvGIX I've read most of these and agree that they are good to have on hard; some technical bits might get a bit dated but core ideas and principles remain.

#DailyDFIR 195: Post from @anthomsec & @x04steve on using automated scanning to track threat actors: https://t.co/85BEGrPKmO It's a good reminder that defense doesn't have to be solely reactive. Having good intel on attacker infrastructure can speed your response considerably.

#DailyDFIR 196: Did you know you can tell when a file attachment was uploaded to #Discord from the URL? Find out how (and much more) when I present on Unfurl at the @DFIRSummit in two days! Agenda: https://t.co/wLC6EYJYgM #DFIR @SANSInstitute #Python #Infosec https://t.co/4j66bcd39a

#DailyDFIR 196: Did you know you can tell when a file attachment was uploaded to #Discord from the URL? Find out how (and much more) when I present on Unfurl at the @DFIRSummit in two days! Agenda: https://t.co/wLC6EYJYgM #DFIR @SANSInstitute #Python #Infosec https://t.co/4j66bcd39a

#DailyDFIR 197: Want to see what information may be hiding in a URL? Come see my presentation on my open source tool Unfurl tomorrow at the @SANSInstitute #DFIRSummit! Agenda: https://t.co/wLC6EYJYgM #DFIR #Python #OpenSource https://t.co/aESkBRbyJs

#DailyDFIR 198: Thanks to everyone who watched my presentation on Unfurl at the #DFIRSummit today! Use Unfurl online: https://t.co/ZfRisFEVnM Get the code: https://t.co/ASz314wAeh It's been a great first day and I'm looking forward to more talks tomorrow! #DFIR @DFIRSummit https://t.co/tfX4wjctk7

#DailyDFIR 198: Thanks to everyone who watched my presentation on Unfurl at the #DFIRSummit today! Use Unfurl online: https://t.co/ZfRisFEVnM Get the code: https://t.co/ASz314wAeh It's been a great first day and I'm looking forward to more talks tomorrow! #DFIR @DFIRSummit https://t.co/tfX4wjctk7