Blog

Daily Blog #551: Forensic Lunch Test Kitchen 11/27/18

Hello Reader,       Tonight we reached another conclusion on our road to understanding of the Amcache hive.Here is what we learned: As Maxim Suhanov pointed out on twitter for Windows 7 there is a schedule task called ‘Microsoft Compability Appraiser’ that runs every night and updates the Amcache On Windows 10 that same task exists but the Amcache is […]

Daily Blog #551: Forensic Lunch Test Kitchen 11/27/18

Hello Reader,       Tonight we reached another conclusion on our road to understanding of the Amcache hive.Here is what we learned: As Maxim Suhanov pointed out on twitter for Windows 7 there is a schedule task called ‘Microsoft Compability Appraiser’ that runs every night and updates the Amcache On Windows 10 that same task exists but the Amcache is […]

Daily Blog #550: Forensic Lunch Test Kitchen 11/26/18

Hello Reader,           Tonight we continued our shimcache testing and here is what we found out tonight: Confirmed again that shimcache will record any executable viewable within the GUI Shimcache will update the record if the executable is modified and then executed Amcache does not immediately update an entry if an executable is modified and executed Sysmon […]

Daily Blog #550: Forensic Lunch Test Kitchen 11/26/18

Hello Reader,           Tonight we continued our shimcache testing and here is what we found out tonight: Confirmed again that shimcache will record any executable viewable within the GUI Shimcache will update the record if the executable is modified and then executed Amcache does not immediately update an entry if an executable is modified and executed Sysmon […]

Daily Blog #549: Sunday Funday 11/25/18

Hello Reader,        Another week of research and discovery is behind us. Let’s push your own knowledge this this weeks challenge! The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday 11/30/18 7PM CST (GMT -5) The most complete answer wins You are allowed to edit your answer after posting If two answers are too similar […]

Daily Blog #549: Sunday Funday 11/25/18

Hello Reader,        Another week of research and discovery is behind us. Let’s push your own knowledge this this weeks challenge! The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday 11/30/18 7PM CST (GMT -5) The most complete answer wins You are allowed to edit your answer after posting If two answers are too similar […]

Daily Blog #548: Solution Saturday 11/25/18

Hello Reader,          Looks like the holiday week took up most peoples times as I didn’t have any qualifying answers this week. Come back tomorrow for next weeks challenge!

Daily Blog #548: Solution Saturday 11/25/18

Hello Reader,          Looks like the holiday week took up most peoples times as I didn’t have any qualifying answers this week. Come back tomorrow for next weeks challenge!

Daily Blog #547: Forensic Lunch Test Kitchen 11/23/18

Hello Reader,            Tonight we had a short late night broadcast as I am enjoying the four day weekend that is Thanksgiving here in the United States. However just because it was short doesn’t mean we didn’t find out a lot of interesting things! Here is what we learned: The desktop executable rbcmd.exe that I didn’t […]

Daily Blog #547: Forensic Lunch Test Kitchen 11/23/18

Hello Reader,            Tonight we had a short late night broadcast as I am enjoying the four day weekend that is Thanksgiving here in the United States. However just because it was short doesn’t mean we didn’t find out a lot of interesting things! Here is what we learned: The desktop executable rbcmd.exe that I didn’t […]

Daily Blog #546: Thanksgiving post 2018

Hello Reader,         When I did the previous year of blogging my wife suggested I post recipes which I did on Holidays. This year I did a sous vide turkey following the recipe in this video: https://www.youtube.com/watch?v=x03Ug4biX-I I did one thing different though, I cooked the turkey breasts to 145 rather than 130 and it made a huge […]

Daily Blog #546: Thanksgiving post 2018

Hello Reader,         When I did the previous year of blogging my wife suggested I post recipes which I did on Holidays. This year I did a sous vide turkey following the recipe in this video: https://www.youtube.com/watch?v=x03Ug4biX-I I did one thing different though, I cooked the turkey breasts to 145 rather than 130 and it made a huge […]

Daily Blog #545: Forensic Lunch Test Kitchen 11/21/18

Hello Reader,          Tonight we continued looking into Amcache and Shimcache in their parts of the application compatibility cache system. Here is what we learned: Command line executions, without GUIs, are not immediately tracked in Amcache but are in Shimcache after two days  Command line executions, with GUIs, are tracked in Amcache after a shutdown, need to […]

Daily Blog #545: Forensic Lunch Test Kitchen 11/21/18

Hello Reader,          Tonight we continued looking into Amcache and Shimcache in their parts of the application compatibility cache system. Here is what we learned: Command line executions, without GUIs, are not immediately tracked in Amcache but are in Shimcache after two days  Command line executions, with GUIs, are tracked in Amcache after a shutdown, need to […]

Daily Blog #544: Forensic Lunch Test Kitchen 11/20/18

Hello Reader,          Tonight we continued our journey into the shimcache and amcache. Here is what we learned: The extracted executable file from the command line that was not executed was still not present in the shimcache Simply viewing the directory in the GUI that the extracted but not executed executable was in was enough to get […]

Daily Blog #544: Forensic Lunch Test Kitchen 11/20/18

Hello Reader,          Tonight we continued our journey into the shimcache and amcache. Here is what we learned: The extracted executable file from the command line that was not executed was still not present in the shimcache Simply viewing the directory in the GUI that the extracted but not executed executable was in was enough to get […]

Daily Blog #543: Forensic Lunch Test Kitchen 11/19/18

Hello Reader,     Tonight we continue to go down further into the application compatibility cache and its associated artifacts. Thanks to tonight’s BFFs (Best forensic friends) Phill Moore, Jessica Hyde and Mike Cary for participating in the testing! Here is what we learned: Approximately 6 hours or so after the tests were done on 11/16/18 in the prior video (https://www.hecfblog.com/2018/11/daily-blog-540-forensic-lunch-test.html) […]

Daily Blog #543: Forensic Lunch Test Kitchen 11/19/18

Hello Reader,     Tonight we continue to go down further into the application compatibility cache and its associated artifacts. Thanks to tonight’s BFFs (Best forensic friends) Phill Moore, Jessica Hyde and Mike Cary for participating in the testing! Here is what we learned: Approximately 6 hours or so after the tests were done on 11/16/18 in the prior video (https://www.hecfblog.com/2018/11/daily-blog-540-forensic-lunch-test.html) […]

Daily Blog #542: Sunday Funday 11/18/18

Hello Reader,         We’ve had some great submissions the last couple of weeks and hoping to get that trend up this week! Following on from this weeks topics lets see how well you can work your forensic tool for registry analysis. The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday 11/23/18 7PM CST (GMT -5) […]

Daily Blog #542: Sunday Funday 11/18/18

Hello Reader,         We’ve had some great submissions the last couple of weeks and hoping to get that trend up this week! Following on from this weeks topics lets see how well you can work your forensic tool for registry analysis. The Prize:$100 Amazon GiftcardThe Rules: You must post your answer before Friday 11/23/18 7PM CST (GMT -5) […]

G-C Partners