Posts Tagged ‘windows forensics’

Malware researchers like to use YARA to identify and classify samples of malicious files. You can create descriptions of malware families based on text or binary samples with YARA.

AlessandroZ has shared the piece of software called ‘LaZagne’. LaZagne uses an internal Windows API called CryptUnprotectData to decrypt user passwords. It is fantastic work!

Playing on emotions, feelings, fears and reflexes of people, intruders get access to the information they are interested in. All these methods are used by attackers when creating phishing emails.

DFIR.Science has shared new video ‘FTK Imager Command Line Physical Disk Hashing’. It tells us how to use FTK Imager command line for creating the hash of the hard disk.