Okay, folks, it's that time of year again. Yes, it's time for the Forensic4cast awards. Eric Huber beat me to it, which could cost me my fanboy status. However, I gave a link to the Awards, so maybe that'll help. :)
Anyway, here's the point: Nominate Kristinn Gudjonsson and log2timeline. For what, though? Well, I'm with Eric on this - Kristinn for Examiner of the Year, and l2t for Forensic Software of the Year. The software wasn't initially developed this year, we all know that, but it has been under constant development, and I think that counts. Anyway, he didn't get the recognition he deserves last year (IMO), so let's get all the l2t fans together and get him in there!
First thing is to nominate, then remember to vote! Be sure to nominate and vote for others as well. There are several categories, so have at 'em. Best Organization (CDFS), Best Blog [cough]this one[/cough], Best Article [cough]Dropbox Forensics[/cough], and so on. Jokes aside, I think the CDFS has a good chance to make a difference in our field, and its leaders have been working very hard to do just that. Be a part, get involved, and also - nominate and vote!
That's all for now.
Update - Just to add another worthwhile one into the mix, even though it is (gasp, aargh) in the same category... RegistryDecoder by Andrew Case and Lodovico Marziale at Digital Forensic Solutions. I've used RegDecoder, and I like it. Easy to use, very useful, does a great job automating registry parsing from an image, multiple extracted files, mounted image set, etc. It will even run against a live system, although I haven't used it that way. You can do keyword searches, build a timeline, and much more. So that should go for Forensic Software of the Year as well. I hate to have to suggest a competitor to l2t, but RD's very good as well. And, competition makes us all better, right?
PS: While you're at it, go vote for RegDecoder on Toolsmith, open until 31 Jan 2012!
Showing posts with label Kristinn Gudjonsson. Show all posts
Showing posts with label Kristinn Gudjonsson. Show all posts
Wednesday, January 18, 2012
Wednesday, June 8, 2011
#DFIRSummit - Afterthoughts, Part 1
I think this tweet by David Kovar sums it up the best:
The only thing that was left out was #corn, but that's another story altogether! I was involved with corn, but I don't think it's my story to tell...
The background on the above tweet was that we had a break after Hal Pomeranz gave a VERY in-depth talk about EXT4, and brains were melting. And he was dancing. Twitter was on fire. Next up was a panel about "the cloud." A group of us on break decided we needed to submit a question that somehow encompassed every topic brought up over the course of the Summit. David Kovar tweeted it and turned in his question card; Andrew Hay read it as the last question, and Cory Altheide autographed his book.
Overall, the Summit was great. The speakers were awesome, it was a great group of folks, and dare I say, a good time was had by all.
I arrived Monday afternoon, and went to the reception. When that was over, we all went to Shiner's with Rob Lee; there was a good group in attendance. And of course, I got to meet Kristinn, which is good for my "fanboy" status ;). For those who think forensicators need to be short, overweight, or bald (as declared by Chris Pogue), well he's none of those. Of course, neither am I. This was my first time to go to something like the Summit, and after a couple introductions from Hal, we were all chatting like old friends. About corn. Very cool. I guess that's what happens when a bunch of crazy geeks get together; our minds are so similar that it's just natural to have a great time!
My wife's comment to me tonight when I got back and was sharing some stuff: "It's like you've died and gone to geek heaven!" She gets me; she so gets me...
Tuesday evening there was an after party at Buffalo Billiards and everyone got to hang out for more good times and conversation. Lest you all think it was nothing more than a big party with drinks galore, there were speakers, presentations, panels, etc. And corn. And that was all very good stuff. Naturally, props go to Kristinn (@killer_dwarf?) for a great presentation about l2t, and everything that tool can now do! However - hope this doesn't damage my status - my favorite was Chris Pogue's talk on "Sniper Forensics." I really enjoyed it, thought it was a great topic and material (and he's a good speaker).
That's it for now, as it's rather late, and I've got a technical webcam check tomorrow morning for a video conference interview tomorrow afternoon. I actually had to leave Summit a little early to head back home and do my own webcam check first in preparation. Tomorrow I will write up a post on my thoughts about the presentations.
LM
The only thing that was left out was #corn, but that's another story altogether! I was involved with corn, but I don't think it's my story to tell...
The background on the above tweet was that we had a break after Hal Pomeranz gave a VERY in-depth talk about EXT4, and brains were melting. And he was dancing. Twitter was on fire. Next up was a panel about "the cloud." A group of us on break decided we needed to submit a question that somehow encompassed every topic brought up over the course of the Summit. David Kovar tweeted it and turned in his question card; Andrew Hay read it as the last question, and Cory Altheide autographed his book.
Overall, the Summit was great. The speakers were awesome, it was a great group of folks, and dare I say, a good time was had by all.
I arrived Monday afternoon, and went to the reception. When that was over, we all went to Shiner's with Rob Lee; there was a good group in attendance. And of course, I got to meet Kristinn, which is good for my "fanboy" status ;). For those who think forensicators need to be short, overweight, or bald (as declared by Chris Pogue), well he's none of those. Of course, neither am I. This was my first time to go to something like the Summit, and after a couple introductions from Hal, we were all chatting like old friends. About corn. Very cool. I guess that's what happens when a bunch of crazy geeks get together; our minds are so similar that it's just natural to have a great time!
My wife's comment to me tonight when I got back and was sharing some stuff: "It's like you've died and gone to geek heaven!" She gets me; she so gets me...
Tuesday evening there was an after party at Buffalo Billiards and everyone got to hang out for more good times and conversation. Lest you all think it was nothing more than a big party with drinks galore, there were speakers, presentations, panels, etc. And corn. And that was all very good stuff. Naturally, props go to Kristinn (@killer_dwarf?) for a great presentation about l2t, and everything that tool can now do! However - hope this doesn't damage my status - my favorite was Chris Pogue's talk on "Sniper Forensics." I really enjoyed it, thought it was a great topic and material (and he's a good speaker).
That's it for now, as it's rather late, and I've got a technical webcam check tomorrow morning for a video conference interview tomorrow afternoon. I actually had to leave Summit a little early to head back home and do my own webcam check first in preparation. Tomorrow I will write up a post on my thoughts about the presentations.
LM
Wednesday, April 20, 2011
Date-Range Specific Timelines
In the prior posts I built a timeline with the new mactime- and csv-format options in log2timeline, I used my bodyfile as input and exported to a nice csv that includes more l2t-related data (as opposed to standard mactime-generated csv). This is nice, but l2t generates one line per timestamp type and gives us a whole lot of rows. Turns out my main timeline was just too much data to be able to load in Excel or Access. Even with 64-bit Win7 and 16 GB of RAM on a Quad-Core processor. Apparently 1.2M rows is just insane. Meh.
I tried to get Kristinn to do things differently, but he just wouldn't see it "my" way. ;) However, in true form, he was extremely helpful. We walked through using grep against an l2t-generated csv to get out some specific sub-ranges that I needed to focus on, like:
This will split out all rows containing data originating (any timestamp type) from February through May of 2009.
Lo and behold! Kristinn also went and created a new module in the nightly build and asked me to help test it. It would automate the process, so you can feed in a date range (kind of like with mactime) and it will pull those dates out of an l2t-generated csv file. Way cool! And so the testing began.
Fortunately by that time I knew my test-set inside and out, so that was helpful in providing him statistics to help track down a few items. In the end, the process was ironed out and works very nicely. I'm not here to post all the specifics, as I know he plans to include it in the next release, and blog about it as well, so I'm leaving that to him. It's his baby, after all. I'm just trying to raise more awareness of this awesome utility, a cool developer, and get more traffic on his sites. Every time I've had a question or problem/concern, Kristinn has been extremely responsive and helpful. Twice now he's written new modules just because I asked if it could be done. Incredible!
I don't think he'll mind me saying that if you're using the nightly build, look for l2t_process; it even has its own man page.
Happy timelining!
LM
I tried to get Kristinn to do things differently, but he just wouldn't see it "my" way. ;) However, in true form, he was extremely helpful. We walked through using grep against an l2t-generated csv to get out some specific sub-ranges that I needed to focus on, like:
head -1 csv.001 > dates.001
grep “^0[2-5]\/[0-3][0-9]\/2009,” csv.001 >> dates.001 This will split out all rows containing data originating (any timestamp type) from February through May of 2009.
Lo and behold! Kristinn also went and created a new module in the nightly build and asked me to help test it. It would automate the process, so you can feed in a date range (kind of like with mactime) and it will pull those dates out of an l2t-generated csv file. Way cool! And so the testing began.
Fortunately by that time I knew my test-set inside and out, so that was helpful in providing him statistics to help track down a few items. In the end, the process was ironed out and works very nicely. I'm not here to post all the specifics, as I know he plans to include it in the next release, and blog about it as well, so I'm leaving that to him. It's his baby, after all. I'm just trying to raise more awareness of this awesome utility, a cool developer, and get more traffic on his sites. Every time I've had a question or problem/concern, Kristinn has been extremely responsive and helpful. Twice now he's written new modules just because I asked if it could be done. Incredible!
I don't think he'll mind me saying that if you're using the nightly build, look for l2t_process; it even has its own man page.
Happy timelining!
LM
Subscribe to:
Posts (Atom)