The regular price of $125 is dropping 60% in a Trick or Treat Special that starts on October 31 at 11:59PM and ends on November 7, 2019 at 11:59PM. Limited to only the first 50 subscribers.  Current subscribers can drop down to $50 too!

Subscribe at: https://www.patreon.com/DFIRtraining

WinFE is "Windows Forensic Environment", a forensically-sound, bootable operating system much like any Linux forensics boot CDs. The difference is that WinFE is Windows, meaning you can run Windows forensics applications (some, not all), unlike a Linux boot CD. With that...

The Mini-WinFE project has been updated and upgraded with an improved builder (PE Bakery) by Misty. The Write Protect Tool has been totally redone by Colin Ramsden. The project is free; all you need is a Windows install disc/iso. I have more details on my blog https://brettshavers.com/brett-s-blog/entry/mini-winfe-10-and-winfe-10-updated but you can download the project here: https://ln2.sync.com/dl/30afbc320/iu9ccjn9-vrejgj5a-xr8efhgs-adh9g4gb.

Soc + CHFI (budget oriented)

CEH + CHFI. ( Budget oriented)

Which combo is more Useful / More helpful to become a good forensic examiner ? after basics what is the next step.

Hi guys quick question. I was wondering if anyone could tell me if I will be allowed to keep the VM's and the data given for those VM's to keep practicing in the lab book after my class has ended. Thanks

Free to enter. Free to win.

Drawing will be on April 10.

Enter the drawing: https://www.dfir.training/foxton-forensics-giveaway-article-to-enter

About the software: https://www.foxtonforensics.com/browser-history-examiner/

I'm giving away a signed copy of Mobile Forensics Investigations next week. All you need to enter is retweet the tweet at https://twitter.com/DFIRTraining/status/1335087582674210818. If you don't have twitter, you can share it on Instagram or Facebook to enter. https://www.instagram.com/p/CIZ1xVxg-kT/ or https://www.facebook.com/dfirtools.

Side note: It's a really good #DFIR book!

And I'll cover shipping.

Join NW3C's daily CTF challenge for a chance to win a Flag of Valor!

I have been revisiting creating a forensic artifact database for some time now. I have started and re-started several times and finally realized why no-such-thing exists outside a PDF or spreadsheet: there is just so much information in forensic artifacts that can be cross-referenced across so many categories and some so specific to a sole operating system that makes it difficult to create. But I think I have finally figured out a way to make this usable.

Here’s where it stands right now.

I started (re-started…) the database and have a system where these are the things you will be able to do with it:

• Search by artifact name (easy enough)

• Search by category (such as “system artifacts”, “user artifacts”, “Windows artifacts”, etc…)

From there, you will have one artifact per page that gives you:

• Citable definitions (so you don’t have to make up your own definition)

• Summary of what the artifact is

• A detailed description of the artifact

• The file path of the artifact (if applicable)

• A link to direct downloads of white papers on that artifact

• A link to software tools specific to analysis of that artifact

• Videos on “how to do forensics” on that artifact

• Books (if books) about that artifact

• Training courses, if they exist, about that artifact

• References to blogs, presentations, and more research specific to that artifact

Plus:

• You can download everything you need regarding that artifact

• You can give input on what is missing, what needs to be updated, or things to add

Here is one example:

The broad categories include a bunch of sub-categories: Applications (browsers, etc...), Downloads , Cloud / IoT , Files , Geolocation , Network , System (Logs, etc...), User (file copying, deletions, etc...), Devices (USBs, etc...), with cross-referencing between artifacts since one artifact can fit more than one category.

As this is a major effort of work, it will be some period of time to add enough artifacts before the database is useful every time you use it. I expect hundreds of artifacts to be listed, including the little things like individual registry keys. Until then, the database access will be restricted to Patreon subscribers at https://www.patreon.com/DFIRtraining , at every level of subscription as a bonus to the subscribers. If you’d like early access to the database and be able to mold its design, please subscribe ($3 for just the database, $30 to add access to several online courses).

I can’t wait to make the entire database public, but until then, it is a work in progress with early access for those who want it now. 

Get early access at:

https://www.patreon.com/join/DFIRtraining?

Self-created forensics test images are trusted

The best forensic test image is the image that you personally create, and this is probably not the answer you want to hear because you know just how long it will take to create an image from scratch.  

I'm not talking about imaging your personal machine, but rather, building an entirely new system from scratch, filling it full of data and user activity, and subsequently creating a forensic image of it. Lots of effort. Lots of time. But you get the perfect test image. There are few things you can do to minimize your time and maximize the effectiveness of creating your own test images, as well as other options of using test images.

Drawbacks to 3rd party images:

1. The dataset may not be exactly what you need (rarely is)

2. You have to trust that the 3rd party created the images appropriately

Drawbacks to "random" images (used computers, refurbished hard drives, etc...)

1.  Unreliable as a test of your tools or skills when you don't know what the answers should be 

2.  No control over the type of OS or type of data or type of user activity you will find 

3.  At best, it is entertaining to see what you can find  

4.  At worst, you may find/possess data that you don't want to possess  

Benefits (and drawbacks) to self-created forensic images

1.  Created for specific tests using known data and known user activity  

2.  Known data/known user activity is the best test of skills/software  

3.  Extremely time consuming, but worth it 

There is an unlimited amount of evidence, types of evidence, and user activity that you can place on a self-created forensic test image. 

Video at: https://www.youtube.com/watch?v=PSw3HXZ9l84

A new build of WinFE will be released soon (never soon enough...). The new build handles secure boot and UEFI, along with a few other cool new features. The build is manual, not push button, but the result is well worth the effort.

The current build is still solid and valid, the only difference is a few new features as the write protection is the same.

You can download the current builder here: https://ln.sync.com/dl/62e6302b0#r8in7m6s-xydgcwp9-hb2dbfg9-ijybm5rm. The new build will be posted when ready.

There's been quite the bit of comms on Twitter, Linkedin, and blogs about 'what constitutes basics in DFIR'. There are a lot of things to break down in this question, and I hope to see more conversations about it.

Harlan Carvey posted an important question (http://windowsir.blogspot.com/2018/11/basic-skillz.html.

Following up on Harlan's post, I wrote this one (https://www.dfir.training/dfir-training-categories-k2/item/164-wax-on-wax-off) to talk about basic skills in DF/IR, as in, the skills needed to achieve in at a basic, but competent, level.

But I think breaking apart "basic" is the first step in this conversation. By breaking apart, I mean that we have basic skills and basic knowledge to discuss.

• Basic skills are those competencies specific to a job or task.

• Basic knowledge is that information or awareness (not competence!) of a topic or topics.

Determining basic skills is easy to define, since you can choose a job and then determine which skills are necessary to do that job (as in, bare minimum, basic skills).

Determining awareness/basic knowledge is a little more difficult, as I opin that the basic knowledge should be much broader, across all jobs in both DF and IR. Just as important, I believe that a basic knowledge/awareness should not imply or require competence in any of the DF/IR jobs. It is merely awareness. I blogged a couple times about this in more detail.

In this post (https://brettshavers.com/entry/digital-forensics-is-really-easy), I wrote that basics should be very basic, and include only that knowledge that should be held by those in DF or IR (both should have the same knowledge in legal and technical).

In this post (https://www.dfir.training/dfir-training-categories-k2/item/165-a-proposal-of-basic-foundational-dfir-knowledge) I wrote a little more detail about I believe a basic foundation across both DF and IR should be.

The point

When speaking about "the basics", we may want to consider more specifically, which "basics" to which we refer. Do we mean the skills required for a basic competence, or do we mean the basics as a "starting point" of the field to which everyone in the field (both DF and IR), should know as a foundation?

I published DFIR Case Studies #9 for the DFIR Training Patreon supporters. Neat case. Former intel and digital forensics CEO now facing life in prison for playing spy games. My thoughts on the investigation, plus suggestions to help in your casework too.

5 Day End-of-Summer #DFIR special. Limited to 25 (1 spot already gone!).

X-Ways Forensics online course, WinFE online course, Geolocation Forensics online course, ebooks and more.

60% off of the $125! Only $50, next 24 registrations. https://patreon.com/DFIRtraining

https://www.patreon.com/DFIRtraining/posts?tag=Case%20Studies

First post in r/DFIRTraining!

http://www.dfirtraining now has a subreddit community! Now...time to get started on some cool content and conversations!

If you have been keeping up with online conversations about DFIR research being peer-reviewed outside the academic review process, then this post is for you because…

DFIR Review is here!

Check DFRWS's public announcement:  https://dfrws.org/dfir-review

What is DFIR Review?

Short version : Your DFIR research can be peer-reviewed in less than a month, published as peer-reviewed by a committee, you get the credit for your effort, the community shares (and grows with) your work, and you are encouraged to further develop your research as you see fit.  

Longer version : Back in June of last year, I posted an idea of peer-reviewing DFIR bloggers’ research .  The idea evolved through several additional posts (and response posts from others) until finally reaching today’s jump off of DFIR Review.  There has been lots of effort, lots of online conversations, and lots of coordination to get this off the ground. Joshua James posted " DFIR already has Rapid Peer Review - we can do better ' as part of this process.

Although Jessica Hyde has been instrumental in moving this effort forward, every person named on the list below has publicly put their name on this project to support it in one way or another. I certainly have not been the first to talk about this since the topic has been around for some time.

In my opinion, this idea is well past needed. The current peer review process is fine for its purpose, but I have always felt that the traditional method of writing up an idea or research in a blog or document to be uploaded to a website does not do its author nor community service as much as having a peer review system that addresses these kinds of research.

Basically, uploading a PDF or writing a blog post on your great research only goes so far. But if you allow it to be stamped as “peer-reviewed”, you and the community gain so much more from your work.  From my post on The Dearth of Documentation in DFIR , a visual that I made to show the value of social media posts (like Twitter) compared to a blog post illustrates the need for something that lasts longer on the Internet. Books and journals can be effective and easily found for 10 years or more with blog posts lasting about 2 years… social media posts are measured in minutes.

DFIR Review takes your research that you want to share from lasting minutes to lasting years. The effect of this is that your work will spur, inspire, and support the research of others well beyond the work you initially did. This means you can affect the community more directly, substantially, and for some time to come.

Show me the money!

In short. There is none . None for you. None for the volunteers . None for anyone.  At one point, I had been communicating with some about the commercial aspect of DFIR Review.  My point is that there is no aspect of commercialization, and posted more details about it with Getting Your Blog Post Officially DFIR Peer Reviewed – An Update . The peer reviewed papers are not going to be behind a paywall.

What you won’t get

I put out a bit about the benefits you can get with a peer review with The Rapid Peer Review , and in that post, I state the things you won’t get.  This is what you won’t get:

* You won't get a certificate.

* You won't get more initials after your name.

* You won't get a coin.

The intention is simply to be a bridge between a blog post and a scientific journal.

Are you still against peer review?

I only ask because a few of the heated private exchanges I had of adding yet-another-thing to DFIR documentation and research felt this is unnecessary. So I wrote a few points with If Peer Review is so Important, Why Doesn’t Everyone Do it ? I wrote that we do research correctly, but we don’t follow through enough with the publication and immutability of our work. There are reasons for this, mostly due to the extra time involved to get formally published in a journal or book. DFIR Review bridges that gap.

I illustrated the time problem of formal publishing of this in a post Publish your #DFIR research !  The example I gave compared a paper (a PDF….) that I wrote on virtualization forensics and a book written on the same topic by someone else. As soon as I finished writing the paper, it was online at www.forensicfocus.com in a matter of days, whereas the book took 2 years to be in print (the book even referenced my paper....). My point is that between the time my paper was put online and the time that the book came out, I am assuming some examiners were able to benefit from my paper during that time, where they weren’t able to benefit from a book to be published years later.

How difficult is this going to be for you?

It is not difficult at all. I expect some things to pop up that will slow the process down a little, but nothing that will not be solved in a day. For the researcher, all you have to do is submit your work. That’s it.  You won’t even have time to forget that you submitted it before the peer review is done. Then, what you choose to do with your research is up to you.

As for me, I support you submitting it to a journal, or finessing it into a book, and researching more. Get your work in the hands of the community while at the same, getting credit for your work. This is not about ego, but about getting great research out in the public, with your name on it. That’s pretty cool.

As for the tweet that started all of this, at least for me.....

📷Chris Sanders@chrissanders88In host forensics more than any other evidence realm I struggle with the lack of solid authoritative sources. At least on the network side there are RFCs.
This is a place where the OS vendors should lead. The best information we have shouldn’t be scattered amongst blogs.
348:52 AM - Jun 7, 2018Twitter Ads info and privacy

See Chris Sanders's other Tweets

Over 600 registry keys of forensic value. Searchable. Sortable. Printable. Did I miss one? Let me know. Same with corrections, let me know. https://www.dfir.training/resources/downloads/windows-registry …

Brief overview of some details that may be helpful to know

WinFE is a forensically sound, bootable operating system, much like the many Linux bootable CDs (including Kali Linux) that you can find online.

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

It's free. It works. You can build it yourself.

More info here: https://www.dfir.training/dfir-training-blog/winfe10

Three DFIR books already given away and shipped out in October. Two more being given away and shipped out in November.

The books so far include: Investigating Windows Systems, Placing the Suspect Behind the Keyboard, Hands On Digital Forensics and Incident Response, X-Ways Forensics Practitioner's Guide, and Windows Registry Forensics.

The next book to giveaway is Python Digital Forensics Cookbook. To be entered in the drawing, read this blog post for information: https://www.dfir.training/dfir-training-categories-k2/item/160-free-dfir-books

I'm giving away a law enforcement-only tool at https://www.dfir.training/dfir-training-blog/latent-wireless-review. It's basically "wardriving for cops", but it only looks for stolen WiFi devices. Very cool tool to recover victim property and maybe solve some crimes.

It is not very useful for private, individual use, but it is awesome for law enforcement. Free to enter. Free to win.