This week I talk about common autorun locations to check during Mac exams

This week I talk about a fast triage methodology to detect persistence on Windows systems

This week I talk about tools available on the SIFT workstation... that you may not know or even there!

This week I talk breakdown certutil exploitation; what it is and methods to detect malicious usage

This week I talk about using layered drivers as an artifact to identify persistence

This week I talk about SOF ELK, a freely available pre-built virtual appliance for DFIR work

This week I start the year with my traditional "back-to-basics" episode, focusing on self-improvement themes and goals to consider

This week I talk about dealing with Base64 evidence.

This week I talk about identifying REGSVC \ REGASM abuse

This week I talk about different types of audit log clearing and detection strategies