Ryuk and GPOs and Powershell, Oh My!

‘Tis the season...for ransomware! Crooks, just like everyone else, are looking to make a little bit of extra money this holiday season so they can get their kids that GI Joe with the Kung-Fu grip (points for whoever gets the movie reference). Recently, I have been pushed to really pay attention to the Trojan/Ransomware landscape, … Continue reading Ryuk and GPOs and Powershell, Oh My!

Wickr. Alright. We’ll Call It A Draw.

Portions of this blog post appeared in the 6th issue of the INTERPOL Digital 4n6 Pulse newsletter.  I would like to thank Heather Mahalik and Or Begam, both of Cellebrite, who helped make the Android database portion of this blog post possible, and Mike Williamson of Magnet Forensics for all the help with the underpinnings … Continue reading Wickr. Alright. We’ll Call It A Draw.

Google Assistant Butt Dials (aka Accidental & Canceled Invocations)

Last week I was at DFRWS USA in Portland, OR to soak up some DFIR research, participate in some workshops, and congregate with some of the DFIR tribe. I also happen to be there to give a 20 minute presentation on Android Auto & Google Assistant. Seeing how this was my first presentation I was … Continue reading Google Assistant Butt Dials (aka Accidental & Canceled Invocations)

Me(n)tal Health in DFIR – It’s Kind of a Big Deal

When I initially started this blog I set a modest goal of making one post a month with the understanding that sometimes life will happen and take priority. Well, life is happening for me this month: an imminent house move, an upcoming presentation at DFRWS USA, the GCFE, and several cases at work have kept … Continue reading Me(n)tal Health in DFIR – It’s Kind of a Big Deal

Two Snaps and a Twist – An In-Depth (and Updated) Look at Snapchat on Android

 There is an update to this post. It can be found after the 'Conclusion' section.I was recently tasked with examining a two-year old Android-based phone which required an in-depth look at Snapchat. One of the things that I found most striking (and frustrating) during this examination was the lack of a modern, in-depth analysis of … Continue reading Two Snaps and a Twist – An In-Depth (and Updated) Look at Snapchat on Android