My goal for the holiday period was to finish @nintendouki.bsky.social #MarioVsDonkeyKong

Goal accomplished on New Years Day 😎

Best news ever!

Free #AppleTV this weekend

That’s my weekend sorted 👍

www.apple.com/tv-pr/news/2...

Me: i’m going to start the year as I mean to go on, with a 2km #DFIRFit run on the treadmill 💪

My treadmill 2mins into the warm up…

Anyone know how to fix a dead @nordictrack.bsky.social S20 (UK)? 🤦‍♀️

It’s not the fuse & I yes I already tried turning it off & on again!

Version 1.6 of #DFIR #parseUSBs is out…

I was interested to see if I could fill in any gaps in assigned drive letters for previous USB connections using LNK data, so this version does exactly that (matching on VSN)

As always, feedback very welcome

github.com/khyrenz/pars...

I got as far as I could on the badge challenges on day1 of @SANSInstitute #CyberThreat24 … tripped up by a micro USB cable 🤦‍♀️🤣

It’s all kicking off in style at @SANSInstitute #CyberThreat

Very important development… the @trafficscotland gritter tracker now has a beta 3D map! Best names ever, every year

Go Icesweeper Willie, go!

Though I still think the best name so far is… Itsy Bitsy Teenie Weenie Yellow Anti-Slip Machiney

www.traffic.gov.scot/gritter-trac...

How do #InfoSec social media apps compare? Stats on my last #DFIR post after 24hrs…

X:
- 5 reposts
- 26 likes
- 2 new followers

Mastodon:
- 2 boosts
- 3 favourites
- 2 followers

Bluesky:
- 6 reposts
- 16 likes
- 7 followers

LinkedIn:
- 13 reposts
- 79 reactions
- 7 followers
- 25 conn requests

🚨 #DFIR Tool update 🚨

I’ve updated parseUSBs (again!):
- Now supports mounted #KAPE images
- Improved deduplication of events within secs of each other
- Added extraction of partition style (MBR/GPT) & Filesystem
- Parses alternate S/Ns
- Parses WPDBUSENUM key

github.com/khyrenz/pars...

Who owns Bluesky? What’s the role of former Twitter CEO Jack Dorsey? What’s Bluesky’s business model? And what prevents another Elon Musk from buying and destroying it? 

@micahflee.com answers your Bluesky questions.

Interesting and potentially problematic from a LE viewpoint - @tazwake.bsky.social did you know about this?

naehrdine.blogspot.com/2024/11/reve...

My #parseusbs #DFIR tool got another small update this week to fix an issue on Linux - now tested on Windows cmd/powershell, WSL (the best shell!), and Ubuntu

Parse USB connection artifacts from a Windows volume, including registry & event log data (or offline hives)

github.com/khyrenz/pars...

Join me in Lisbon next week for lots of @sansforensics #FOR500 Windows forensics fun. I’ve discovered some fun new things about USB connection artifacts that I’ll be sharing first at this event, so you’ll want to be around for all that!

Sign up here: sans.org/u/1yrB

This git is full of resources for event logs/auditing. Covers everything from tool configs to audit cheatsheets to event attack chains and data samples. In #DFIR visibility is key. This is a solid resource for those responding to an incident or trying to prevent one. #grc

github.com/stuhli/aweso...