Comments for cmdLabs http://blog.cmdlabs.com Sun, 05 Jun 2011 13:39:58 -0700 hourly 1 http://wordpress.org/?v=3.0.1 Comment on Geolocational Log Analysis: Think Globally, Act Locally (with code) by T. Harper http://blog.cmdlabs.com/2011/06/02/geolocational-log-analysis-think-globally-act-locally-with-code/comment-page-1/#comment-14548 T. Harper Sun, 05 Jun 2011 13:39:58 +0000 http://blog.cmdlabs.com/?p=264#comment-14548 Thanks for the work that went into this. I'm sure the community appreciates it as well. The Maxmind API/databases have a lot of potential. Good Job! Thanks for the work that went into this. I’m sure the community appreciates it as well. The Maxmind API/databases have a lot of potential. Good Job!

]]> Comment on Geolocational Log Analysis: Think Globally, Act Locally (with code) by H. Carvey http://blog.cmdlabs.com/2011/06/02/geolocational-log-analysis-think-globally-act-locally-with-code/comment-page-1/#comment-14545 H. Carvey Fri, 03 Jun 2011 14:56:27 +0000 http://blog.cmdlabs.com/?p=264#comment-14545 Brian, Great post! I've done something very similar, albeit submitting WAP MAC addresses found in the Registry to the SkyHook database to see if they've been mapped to a lat/long, and if so, create a Google Map with a push-pin on the location. This is very helpful during investigations... Brian,

Great post! I’ve done something very similar, albeit submitting WAP MAC addresses found in the Registry to the SkyHook database to see if they’ve been mapped to a lat/long, and if so, create a Google Map with a push-pin on the location. This is very helpful during investigations…

]]> Comment on Geolocational Log Analysis: Think Globally, Act Locally (with code) by Ron Weiss http://blog.cmdlabs.com/2011/06/02/geolocational-log-analysis-think-globally-act-locally-with-code/comment-page-1/#comment-14544 Ron Weiss Fri, 03 Jun 2011 11:09:54 +0000 http://blog.cmdlabs.com/?p=264#comment-14544 Good stuff Brian. This sort of tool has been very useful in helping identify the compromised accounts of customers. Although I was kind of shocked to find one account for a US company being accessed from Nepal.. but the customer confirmed they had people doing work there! Thanks for sharing. Good stuff Brian. This sort of tool has been very useful in helping identify the compromised accounts of customers. Although I was kind of shocked to find one account for a US company being accessed from Nepal.. but the customer confirmed they had people doing work there! Thanks for sharing.

]]> Comment on Handbook of Digital Forensics and Investigation Released by Digital Evidence & Computer Crime, 3rd Edition Released « cmdLabs http://blog.cmdlabs.com/2010/02/03/handbook-of-digital-forensics-and-investigation-released/comment-page-1/#comment-14541 Digital Evidence & Computer Crime, 3rd Edition Released « cmdLabs Tue, 31 May 2011 15:12:04 +0000 http://blog.cmdlabs.com/?p=130#comment-14541 [...] This material provides the foundation for the more advanced companion text, the Handbook of Digital Forensics and Investigation. [...] [...] This material provides the foundation for the more advanced companion text, the Handbook of Digital Forensics and Investigation. [...]

]]> Comment on Delving into Mobile Device File Systems by Salvaging Digital Video Fragments « cmdLabs http://blog.cmdlabs.com/2009/12/10/delving-into-mobile-device-file-systems/comment-page-1/#comment-14540 Salvaging Digital Video Fragments « cmdLabs Mon, 30 May 2011 20:12:08 +0000 http://blog.cmdlabs.com/?p=128#comment-14540 [...] using such a mobile device forensic tool and extracting the video content as discussed in the “Delving into Mobile Device File Systems” blog post results in a 3gp file that can be played using VLC media [...] [...] using such a mobile device forensic tool and extracting the video content as discussed in the “Delving into Mobile Device File Systems” blog post results in a 3gp file that can be played using VLC media [...]

]]> Comment on Winner of the DFRWS2010 Forensic Challenge Announced by softkeybarsetting http://blog.cmdlabs.com/2010/08/30/winner-of-the-dfrws2010-forensic-challenge-announced/comment-page-1/#comment-9385 softkeybarsetting Fri, 28 Jan 2011 10:40:23 +0000 http://blog.cmdlabs.com/?p=249#comment-9385 The implication is that, once full physical dumps of NAND and/or NOR memory are obtained from a mobile device, simple text extraction and file carving techniques can provide significant amounts of useful information, including deleted data.? The implication is that, once full physical dumps of NAND and/or NOR memory are obtained from a mobile device, simple text extraction and file carving techniques can provide significant amounts of useful information, including deleted data.?

]]> Comment on The Pitfalls of File Initialization for Forensic Analysts by Anonymous http://blog.cmdlabs.com/2010/03/17/the-pitfalls-of-file-initialization-for-forensic-analysts/comment-page-1/#comment-2029 Anonymous Thu, 22 Apr 2010 22:19:39 +0000 http://blog.cmdlabs.com/?p=157#comment-2029 Funny how this doesn't occur on FAT12 eh ,Eoghan. ;) Funny how this doesn’t occur on FAT12 eh ,Eoghan. ;)

]]> Comment on The Pitfalls of File Initialization for Forensic Analysts by H. Carvey http://blog.cmdlabs.com/2010/03/17/the-pitfalls-of-file-initialization-for-forensic-analysts/comment-page-1/#comment-1391 H. Carvey Sun, 21 Mar 2010 13:05:10 +0000 http://blog.cmdlabs.com/?p=157#comment-1391 Eoghan, Excellent post! I think that this really goes toward answering a number of questions folks may have with respect to file system search results, etc. Thanks for putting this out there! Eoghan,

Excellent post! I think that this really goes toward answering a number of questions folks may have with respect to file system search results, etc. Thanks for putting this out there!

]]>