Monthly Archives: September 2014

Link Files

Link (lnk) files are a valuable source of information in a forensic investigation and should not be casually overlooked. What are Link files? Link files are created by the system when a file is opened, even if that file is … Continue reading

Posted in Link FIles, Windows Forensics | Tagged , , , , , | Leave a comment

Jump Lists

What is a Jump List? A Jump List looks something like: From left to right we have; Windows Media Player Start Menu, Wordpad Internet Explorer Jump Lists were introduced in Windows 7 to allow frequently used files/tasks/webpages to be selected … Continue reading

Posted in Jump Lists, Windows Forensics | Tagged , , , , , , , , | Leave a comment

Incident Response Process Phase 3 – Containment

First Steps When moving into the containment phase an incident has already been declared. It is now time to categorise the incident and relay this to the customer/management. The categorisation or characterisation of the incident can be broken down into … Continue reading

Posted in Containment, Incident Response | Tagged , , , | Leave a comment

Photos and who to blame

In light of the recent apple/icloud incident I thought I would bring up a little bug bear of mine. Blaming the victim, if you are mocking the celebrities and commenting on how “it’s their own fault” please stop. Why do … Continue reading

Posted in Cyber, My Two Cents | Tagged , , , , | Leave a comment