The USN Journal, also known as the Update Sequence Number Journal, is a feature of the Windows operating system that serves as a record of changes made to files and directories on a disk volume. It provides valuable information and insights into file system activities, which can aid investigators in reconstructing events, understanding system behavior, and uncovering evidence. This week I break down the artifact from a DFIR point of view provide triage strategy.....

This week Jason Roslewicz from SUMURI returns for some web 3.0 and virtual reality talk.

This week I talk about adding, modifying, and removing network shares through the lens of detecting lateral movement.

This week I break down the three Windows task hosts from a DFIR point of view.

This week I talk about network share access events and lateral movement detection.

This week Jason Roslewicz from SUMURI returns for some cloud talk.

This week I talk about the exploitation of the Windows Management Instrumentation application.

This week Chris Currier and I talk about mobile forensics and protocol buffers.

This week I cover Windows events commonly associated with data spoliation and insider threats.

This week Jason Roslewicz from SUMURI returns for some ransomware talk.