Comments on: Windows Incident Response and Forensics http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/?utm_source=rss&utm_medium=rss&utm_campaign=windows-incident-response-and-forensics Helping the Perl world cope with Windows Wed, 20 Jan 2010 09:22:44 +0000 hourly 1 http://wordpress.org/?v=3.0 By: TSgt_Mad http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/comment-page-1/#comment-745 TSgt_Mad Fri, 29 Jun 2007 11:40:07 +0000 http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/#comment-745 Hi Mr Carvey Your book is awesome. However, i cannot get to your site because the domain blogspot is blocked. Any other URL's or if its ok with Mr Roth, can you post more here? Thanks JM Hi Mr Carvey

Your book is awesome. However, i cannot get to your site because the domain blogspot is blocked. Any other URL’s or if its ok with Mr Roth, can you post more here?

Thanks

JM

]]> By: keydet89 http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/comment-page-1/#comment-5 keydet89 Fri, 20 Oct 2006 12:46:51 +0000 http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/#comment-5 Here's a good use for Perl and WMI: http://windowsir.blogspot.com/2006/10/restore-point-forensics.html Drop me a line if you'd like to see the code... Harlan keydet89 at yahoo dot com Here’s a good use for Perl and WMI:
http://windowsir.blogspot.com/2006/10/restore-point-forensics.html

Drop me a line if you’d like to see the code…

Harlan
keydet89 at yahoo dot com

]]> By: keydet89 http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/comment-page-1/#comment-4 keydet89 Thu, 12 Oct 2006 19:45:50 +0000 http://www.roth.net/blog/index.php/2006/10/04/windows-incident-response-and-forensics/#comment-4 Dave, I appreciate the shout-out. Yes, I do all my stuff in Perl...thanks to you! I'm working on some WMI stuff for SysAdmin work, I have some cool WDM stuff that has to do with wireless on managed systems. Some of the stuff I've been working on involves parsing binary file formats in a platform-independant manner...using "V" and "v" in my unpack() strings to force little-endianness...stuff has worked on Linux, as well as on MacOSX, both x86 and PPC platforms. This pertains to RAM dumps (using dd, or VMWare .vmem files), raw Registry files, etc. I posted a couple modules on CPAN as well. One parses PE file headers in a binary format, bypassing the MS API. The same is true with pre-Vista Event Logs. There's also a module for pulling metadata from Word docs, using both binary file formats, and OLE storage mechanisms. I'm always looking for ways to make my job as a forensic analyst easier... Dave,

I appreciate the shout-out.

Yes, I do all my stuff in Perl…thanks to you! I’m working on some WMI stuff for SysAdmin work, I have some cool WDM stuff that has to do with wireless on managed systems.

Some of the stuff I’ve been working on involves parsing binary file formats in a platform-independant manner…using “V” and “v” in my unpack() strings to force little-endianness…stuff has worked on Linux, as well as on MacOSX, both x86 and PPC platforms. This pertains to RAM dumps (using dd, or VMWare .vmem files), raw Registry files, etc.

I posted a couple modules on CPAN as well. One parses PE file headers in a binary format, bypassing the MS API. The same is true with pre-Vista Event Logs. There’s also a module for pulling metadata from Word docs, using both binary file formats, and OLE storage mechanisms.

I’m always looking for ways to make my job as a forensic analyst easier…

]]>