2019 Unofficial Defcon DFIR CTF

Hello Reader,       It’s that time again! First of all here is the important things you came here for: 1. Link to download this years images 2. Link to the CTF site: This year Champlain College’s Digital Forensic Association saved the day by providing a CTF they hadn’t released to the general public. Matt and I have been a little busy […]

National CCDC 2019 Red Team Debrief

Hello Reader,   Here are the slides for this years debrief.

Daily Blog #660: Solution Saturday 4/13/19

Hello Reader,           This weeks winner only recently discovered the blog and the contests therein. Why bring this up? It shows that you don’t have to be around for years to have a chance at winning a Sunday Funday. In Michael’s case he posted a comment with an answer and sent me an email, and when he […]

Daily Blog #659: Sunday Funday 4/7/19

Hello Reader,           Sounds like Google Compute DFIR knowledge must be sparse based on the responses I’ve gotten .. namely none! So let’s change platforms to see how well you know PaaS, Platform as a Service specifically Dropbox. The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday 4/12/19 7PM CST (GMT -5) The most […]

Daily Blog #658: MUS 2019 DFIR CTF Perfect Score Achieved

Hello Reader,           Just a note that we already have a perfect score winner! Congratulations to Plop aka Bastien Lardy who I will be contacting about their prize! The CTF will remain up for quite some time to allow all of you a chance to learn and get ready for the big DFIR CTF of the year, […]

Daily Blog #657: MUS2019 DFIR CTF open to the public

Hello Reader,    The DFIR CTF that we ran at the magnet user summit is now open to the public. You can download the evidence and a 30 day license key for Magnet Axiom here: You can register for the CTF and play here:

Daily Blog #656: Forensic Lunch 4/3/19 Live from MUS2019

Hello Reader,           Today we had a Forensic Lunch live from the Magnet User Summit 2019 with guests: Kevin Pagano talking about his experience playing (and winning) the MUS2019 DFIR CTF Jessica Hyde and Jad Saliba talking about whats next for Magnet  You can watch the video here:

Daily Blog #655: Magnet User Summit DFIR CTF 2019 Results

Hello Reader,             We had a great CTF today that will soon be released to the public. I’m happy to announce the top three winners. #1 Kevin Pagano#2 Jonathan Rajewski#3 Santiago Ayala Prizes were given away and more prizes await those who will now compete in the online public offering that will be released thursday Until […]

Daily Blog #654: Sunday Funday 3/31/19

Hello Reader,           No April Fools this week I didn’t post an answer for last weeks challenge because … I didn’t receive any qualifying answers. So let’s try this again shall we? A second week to show the world your expertise with the google cloud. The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday […]

Daily Blog #653: Forensic Lunch Test Kitchen 3/26/19

Hello Reader,        Tonight I tried to do a live stream from my hotel in  Jeddah, KSA. Looking back at the recording I’m not sure how well it did but I was able to get some base testing done for a better test of some SRUM recording features tomorrow night UTC +3. In short I did the following […]

Daily Blog #652: Seeking Sponsor for the Unofficial Defcon DFIR CTF 2019

Hello Reader,        Do you or your company want to provide a prize for the Unofficial Defcon DFIR CTF now in its third year? If so email me at so we can talk. In the past SANS, Magnet Forensics, Blackbag and Metaspike have all graciously provided prizes for our worthy contenders and we’d like to open this […]

Daily Blog #651: Sunday Funday 3/24/19

Hello Reader,   Let’s finish this trifecta of the major three cloud compute vendors. I think that getting more of this knowledge out there will many random internet searches just trying to understand whats possible, when someone else made a decision to move their assets to the cloud. We have a streak of new winners and you, yes you, reading this […]

Daily Blog #650: Solution Saturday 3/23/19

Hello Reader,         This week’s challenge was met with many challenges but they were overcome by @darizotas aka Dario B. I think you’ll see in his winning post that did a pretty thorough job documenting what existed with solid references for following up. I’m loving all of these new people in the community getting involved and showing what […]

Daily Blog #649: How to pick something to test

Hello Reader,         One of the questions I get asked on a semi regular basis is, how do I pick what to test/research? The answer is more simple than you would expect: Selection pool:  I look at an interaction I just experienced while using the operating system I think about an artifact I don’t feel I full understand […]

Daily Blog #648: How to stream your own test kitchen

Hello Reader,       As I prepare to get the test kitchen back in service I thought I’d share what I use for others who are looking to do the same. I got this idea after this tweet from Gerald Davis So here is my setup:Hardware: I have a Windows 10 desktop with a Nvidia GTX 980 an i7 processor […]

Daily Blog #647: Windows Forensics in San Diego

Hello Reader,                Looks like I’ll be heading to sunny San Diego California to teach SANS FOR500: Windows Forensics this May 9 2019. The event is called Security West and its one of the bigger SANS events of the years. If you wanted to learn Windows Forensics, see San Diego and see some great […]

Daily Blog #646: Sunday Funday 3/17/19

Hello Reader,              I always appreciate it when people spend their time researching rather than doing other fun things, like playing video games or reading a non-technical book. When we share what we know, even if we don’t know everything about something, it helps someone else leap frog forward and learn more. This week let’s […]

Daily Blog #645: Solution Saturday 3/16/19

Hello Reader,         Spring break is ending which means kids are going back to school soon and I’ll be back on track with blogging. Here is this weeks winner! The Challenge:Name and describe all of the available forensic data sources provided by Amazon AWS for EC2 The Winning Answer:Jonathan Yan CloudTrail LogsCloudtrail is an audit log that is […]

Daily Blog #644: Creating decrypted images of APFS file systems encrypted with T2 Chips with Macquistion

Hello Reader,          Dealing with T2 Chips on recent model Macbooks has been a real pain point for us in the lab so I was very, very happy to read that Blackbag (thanks Joe and Vico!) have figured out how to transparently decrypt the physical blocks of a drive being managed by a T2 chip at imaging […]

Daily Blog #643: Sunday Funday 3/10/19

Hello Reader,        On this blog we focus on a lot of host related issues, but the world is no longer confined to single on premises hosts anymore. This week let’s set our challenge sights to the skies and start seeing what you can research about … the cloud. The Prize:$100 Amazon GiftcardThe Rules: You must post your […]

G-C Partners