The latest version of this presentation is available in the Resources section of this website.
Enjoy!
Ubiquity Forensics - CEIC 2015
Click here for the newest presentation slides from CEIC 2015.
I hope I'll be seeing some of you bright and early at the 9am presentation!
Apple Watch Forensics - A Quick Preview
Heather Mahalik and I had the pleasure of presenting a quick rundown of what we found in iOS backups for the brand spankin' new Apple Watches that we just got. (BTW - Yes, I'm loving it. Big surprise there!)
We presented this last week as SANS Security West. Keep an eye out for more information, there was quite a bit that we were not able to cover in our 18 minute lightning talk.
HFS+ Grammar Updates – Now with Windows & Linux Support!
Updated HFS+ Grammars:
My Synalyze It! HFS+ grammars have been updated thanks to some feedback from ‘Cugu’ who pointed out an error in the Reserved Field in the Header Record. It should have been 4x16 bytes, not just 4 bytes. Thanks ‘Cugu’! The updated grammars can be accessed in the Resources Section.
Windows & Linux Support:
Windows and Linux support for the Synalyze It! Grammars are now available by using Hexinator by the same creator as Synalyze It! This program appears to be free as of this writing. Hexinator works and feels just like Synalyze It!
An example of Hexinator with my HFS+ Catalog File Grammar.
Updates - June 2014
in update
A few updates to the website:
Resources Section:
The Resources section now contains the Synalyze It! grammars for HFS+ that I created. Just a reminder – these are work in progress; I will update them as needed.
Also in the Resources section is the most current version of my presentations. If you attended one of my presentations in the past and want that specific copy, please feel free to contact me.
- Reverse Engineering Mac Malware – A basic walk though of static and dynamic reverse engineering of Mac malware on a Mac. Approximately 20% static, and 80% dynamic analysis. No assembly knowledge needed!
- When Macs Get Hacked – Intrusion analysis on the Mac - where and what to look for to find Mac malware doing a dead-box forensic analysis.
- Analysis and Correlation of Mac Logs – Mac systems log a ton of data! This presentation helps correlate this information with other system artifacts to give the analyst a better view of what happened on the system.
I will be teaching my FOR518: Mac Forensic Analysis at the SANS DFIRCON East 2014 conference in Ft. Lauderdale, Florida in early November. Visit here for more information.
Just a reminder, I will also be co-teaching FOR518: Mac Forensic Analysis with Hal Pomeranz at the following locations in the Fall:
On a budget? If you are looking to get into FOR518: Mac Forensic Analysis at HALF-PRICE(!), seats are still available in the second beta of the class in San Jose, CA in July. Sign up soon! Sign up here. I will be attending the class, while the great Unix god himself – Hal Pomeranz teaches. I assure you he will drop some serious command line kung fu upon us.