In one of my previous blogs I was talking about what happens when a file is deleted on a Windows system. Today I want to talk about another very interesting topic, time stomping and how to detect it. I heard this as a question a few times in interviews, although in practice I didn’t see …
How to detect timestomping (on a Windows system) Read More »
The million dollar question of any interview for a DFIR role. What happens when a file is deleted, what changes occur and how one can still find evidence of the file’s existence after the file was deleted. I personally heard this question in interviews for all roles that required experience in digital forensics. Next (as …
What happens when a file is deleted (on a Windows system) Read More »
This could easily be the subject of a book. And as a matter of fact, there are quite a number of books out there about how to run a SOC for optimal resource usage and business alignment. In this post however, I want to give you just a high-level overview of the big picture of …