A Blog on computer and digital forensic research, DFIR programming, the forensic lunch and more wirrten by Hacking Exposed Computer Forensic author David Cowen
Hello Reader, It happens to everyone and yesterday it happened to me. I was traveling and lost track of the day and realized I didn't post a blog yesterday. I just want to acknowledge it so you know a couple things. 1. It's ok to make a mistake 2. Just because I missed a day doesn't mean that I won't stop posting, just means I missed a day. 3. I'm human just like everyone else. So take your…
Hello Reader, It's an Eng world and we are just living in it, unless of course you take the time to put in an entry this week and win! This week we are changing courses to an old file system problem with some utilities. The Prize: $100 Amazon Giftcard The Rules: You must post your answer before Friday 4/25/25 7PM CST (GMT -6) The most complete answer wins You are allowed to edit your answer after…
Hello Reader, Another week has come and gone but Chris Eng's streak continues unbroken! It's up to all of you to decide if you are ready to step up to the challenge tomorrow for this weeks challenge! The Challenge: It's becoming more common that the first thing an attacker will try to do if they get access to a user's system is extract all of the saved browser passwords. Profile a popular browser…
Hello Reader, Welcome back to another installment in the AWS CloudTrail speed test series . Today’s focus shifts to the opposite of yesterday’s action: RemoveUserFromGroup . This event is triggered when you revoke permissions by removing an IAM user from a group. Fifth Test: AWS RemoveUserFromGroup Event For this test, I removed a user from an existing IAM group, which typically results in an…
Hello Reader, Continuing our series on AWS CloudTrail speed tests , today’s test focuses on a new IAM-related action: AddUserToGroup . This event is generated when you modify a user’s permissions by assigning them to an IAM group which would grant additional permissions. Fourth Test: AWS AddUserToGroup Event Today’s scenario involved changing account permissions by adding an IAM user to a group.…
Hello Reader, Continuing from yesterday’s post, it's time for another AWS CloudTrail speed test . Today, I’m examining the CreateUser event, which is triggered when a new IAM user is created in an AWS account. Third Test: AWS CreateUser Event Going into this test, I knew that IAM events which are global are logged in us-east-1 . It’s often the default region for global events and appears first in…
Hello Reader, Continuing from yesterday’s post, it's time for another AWS CloudTrail speed test . Today, we're testing the CreateAccessKey event, which occurs when a new Access Key ID is created for an IAM user. Second Test: AWS CreateAccessKey Event When I first ran this test, I wasn’t sure which region the log would appear in. Unlike the console sign-in URL, IAM is a global service . That means…
Hello Reader, In a recent Sunday Funday discussion, I asked about the actual log delay across the major cloud providers. By log delay , I mean the time it takes for an event to appear in a cloud provider’s audit log after it has occurred. Chris Eng did a solid job documenting this behavior for Azure , but didn’t cover AWS or Google Cloud . So, this post kicks off a new blog series where I’ll be…
Hello Reader, This week I'm hoping for more of you to get involved and give Chris Eng some competition. With that in mind I'm going to make this challenge as accessible as possible but still have an outcome that increases the overall knowledge of the field. So let's get started on this week's browser stored credential challenge. The Prize: $100 Amazon Giftcard The Rules: You must post your answer…
Hello Reader, This week Chris Eng comes back again with some research in his own Daily Blogs about WSL. While I think we can all appreciate Chris's winning streak I'm looking for all of you to come out in force this coming week to challenge him for a win! The Challenge: What artifacts are left behind when running a docker container using Ubuntu WSL (which I believe is the default standard. Bonus…
Hello Reader, If you've ever done forensics on modern linux systems disk images you may have encountered the dread that comes with dealing with lots of LVMs (Logical Volume Management) which none of the commercial forensics tools seem to be able to fully handle, yes even Xways. Well instead of being full of existential dread of having to export, reimport and handle all of these partitions you can…
Hello Reader, I'm excited to share some news today—Evan Anderson, who you might recognize from our Vibe Coding livestreams, has just launched a new product: Puck ! Puck (available at puck.tools ) is the result of Evan’s 20 years in cybersecurity, including extensive experience in offensive operations and advanced red team deployments. At its core, Puck simulates a threat actor within your network…
Hello Reader, Yesterday, when I shared my presentation, I mentioned that while I conducted all the research myself, I used ChatGPT-4o to create all of the slides. Why? Because I have absolutely no artistic skills—but I did have all the technical knowledge I wanted to communicate. If you’re like me and want your presentations to look like you hired a professional designer, here’s how I made it…
Hello Reader, Today I gave a presentation on Windows Hello Forensics to the HTCIA Northeast chapter. I wanted to share the presentation here for the attendees and anyone else interested in seeing it all the prior blog posts data in one place. If you like the slides I made them using Chat GPT 4o and I'll go through the prompts I used in tomorrows blog! You can download them here:…
Hello Reader, As you have noticed I've been really enjoying all the newest and strangest things you can do with all of the AI models as they've come out. While everyone has been focusing on how you can 'ghibli' , 'barbie' or 'lego' a photo I realized you can do something even better! You see in the recent past Chat GPT 4o refused to create images based on real people, even your own face. However…
Hello Reader, This week I wanted to turn your attention to WSL or Windows Subsystem for Linux. With WSL becoming more common on windows systems for things like Docker its been awhile since I've seen a lot of research around whats left behind from it's usage. Let's see what you can do! The Prize: $100 Amazon Giftcard The Rules: You must post your answer before Friday 4/11/25 7PM CST (GMT -6) The…
Hello Reader, This week no one managed to submit a full answer as I did ask for all three major clouds. The closest with Chris Eng who did a full review of Azure and found times that were much faster than the last time I checked! It does look like I need to go back and do my own tests and write them up here. The Challenge: For the main cloud providers (AWS, Azure, Google Cloud) determine how long…
Hello Reader, Today Evan and I used Replit to create a digital forensic artifact website. While the website itself needs alot of content to be useful the fact that it created, tested, and deployed it within an hour is really impressive considering neither of us had used replit before. Here is the website it made: https://autodavecowen.replit.app/ Here is the video: Also Read: Azure Snapshot…
Hello Reader, One of my favorite features in Azure is how easy it is to work with virtual disk snapshots. When you create a snapshot of a virtual disk (VHD), Azure lets you generate a direct download link for the raw disk—no extra steps needed. Compare that to other cloud platforms: In AWS , I have to use tools like coldsnap In Google Cloud , I need to convert the snapshot into an image first But…
Hello Reader, I've been exploring an effective new use case with various AI models: using them to generate queries across different Endpoint Detection and Response (EDR) platforms. Depending on the client, I regularly switch between multiple EDR solutions, including CrowdStrike Falcon, SentinelOne, Carbon Black Cloud, Palo Alto Cortex XDR, and Microsoft Defender. While I typically know exactly…
Hello Reader, In the last post we focused on the made up blog posts Gemini cited. Now let's look at some of the facts it stated in regards to how long these artifacts will exist for. When talking about prefetch files it does well "Limited number of files (e.g., 1024 on Win 10/11). Oldest files are deleted on a FIFO (First-In, First-Out) basis." But when talking about LNK files which have a similar…
Hello Reader, In last week's post I posted a document that Google Gemini 2.5 Pro created regarding Windows 11 execution artifacts. This week I want to break down where Gemini just made stuff up or was incorrect. The point here is you still need to check the AI model's work and know how and when to use it in your own work. Today let's start with something simple, the blog links referenced. Here's…
Hello Reader, Every week I ask myself, what do we not know? This week I want to focus your combined attentions to log delivery delays in the cloud. Each cloud has pros and cons when using it, so lets find out which one gets you failed logins the fastest. The Prize: $100 Amazon Giftcard The Rules: You must post your answer before Friday 4/4/25 7PM CST (GMT -6) The most complete answer wins You are…
Hello Reader, This week we challenged you to find out what SSH artifacts are left behind on Windows systems that now have native SSH servers and clients. It shouldn't be a surprise that the person who suggested the Windows angle was also the person who won! Congrats to Chris Eng! The Challenge: Test what artifacts are left behind from SSHing into a Windows 11 or 10 system using the native SSH…
Hello Reader, One of things I've been waiting for is an AI model to have enough of a context window (space to hold an entire thought) to list out forensic artifacts by type so that it could assist in create DFIR training materials and cheat sheets. Google Gemini has always claimed one of the largest context windows at 2.5 million so I thought I'd put it to the test and see how many Windows 11…