Daily Archives: May 23, 2014

Network History and Decoding System Time

Posted on May 23, 2014 by HatsOffSecurity

Following on from my last post we had a GUID starting C1CDD (normally I would write the whole GUID down, but for the sake of not boring you all, I will keep it short), in this post we are going … Continue reading →

Posted in Decoding Time, Windows Forensics, Windows Registry Forensics | Tagged , , , | Leave a comment

Network Interfaces

Posted on May 23, 2014 by HatsOffSecurity

Having the last known IP address of a machine can help you to identify if it was in the wrong segment of the network (everyone does segment their network…. right?), if the address was static or dynamically assigned or if … Continue reading →

Posted in Windows Forensics, Windows Registry Forensics | Tagged , , | Leave a comment