Here it is. The presentation I was due to give at the SANS EU Forensic Summit. Hope you find it useful.
Bare in mind you’ll have to have iTunes or Quicktime installed to watch this. I’ll work on getting it into other formats later.
Enjoy!
Here it is. The presentation I was due to give at the SANS EU Forensic Summit. Hope you find it useful.
Bare in mind you’ll have to have iTunes or Quicktime installed to watch this. I’ll work on getting it into other formats later.
Enjoy!
3 responses to “Presentation – Into the Shadows”
Outstanding presentation, Lee! I enjoyed it very much and will most likely watch it again. Good stuff!
KP
FYI, Lee, the index block header you list as 6B87083876C1484EB7AE04046E6CC7520100 is actually the now familiar guid {3808876b-c176-4e48-b7ae-04046e6cc752} followed by the WORD value 0x0001. Thanks for the presentation.
Thanks Charles, someone had already pointed this out to me on one of the list-servs. When they told me I face-palmed. How could I miss that? I’d already done all the difficult stuff. Oh well, you live and learn I guess.
If anyone has anything to add please let me know, I do not proclaim myself to be the most knowledgeable on the subject and would welcome any input.