你屏蔽了 @AlexisBrignoni
确定要查看这些推文吗？查看推文不会取消屏蔽 @AlexisBrignoni
-
置顶推文
Available to everyone now. Check it out
https://twitter.com/13CubedDFIR/status/1247124267910811648 …谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Here is the written version (blog post) of the Houseparty iOS app: Realm DB analysis video. Thanks to
@josh_hickman1 for his incredible work in providing iOS and Android test images to the#DFIR community. You rock!
https://abrignoni.blogspot.com/2020/04/ios-houseparty-app-more-realm.html …显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Have you ever wondered how doing forensics from a coat closet looks like? Are you nostalgic about the size of your first
#DFIR lab? If so I have the video for you! Houseparty iOS app analysis: Realm DB Straight from my home "office."
https://m.youtube.com/watch?v=MmZl4rxz3q8 …显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Meanwhile in my neighborhood... Florida man & his Florida neighbors.pic.twitter.com/yQaeuiNZQD
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销
-
I should frame this tweet from
@mainframed767 and hang it next to my servers. Well played sir.pic.twitter.com/LU7FOqs8uZ
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Samsung Smart Manager, Samsung Members, & Context Log blog post. Tons of information on app usage and app activity. I find the App Sub ID data to be really useful to characterize app usage activity.https://abrignoni.blogspot.com/2019/07/android-samsung-traces-of-deleted-apps.html …
显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Samsung My Files blog post. Keeps track of media. Source and destination. One of my favorite artifacts.https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html …
显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Samsung only Android
#DFIR artifacts added for ALEAPP:
My Files database - Stored & recent media
Smart Manager - Crash & app log
Members - App inventory & events
Context Log - App usage log
Artifact details in the thread.
Download ALEAPP: https://github.com/abrignoni/ALEAPP …pic.twitter.com/KRLBxJMgFq
显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
#DFIR SQLite Journaling strings extraction in ALEAPP.
Extract all ascii & unicode strings in .journal / .wal files.
See remnants of deleted / pending transactions.
Quick targeting of pertinent files for deep dive analysis with specialized tools.
https://github.com/abrignoni/ALEAPP …pic.twitter.com/XkoRyM76CG
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
April 23-24 | Virtual
@sansforensics#DFIR Netwars! If control == 0: print('
I like it') https://twitter.com/edskoudis/status/1251309608746049536 …pic.twitter.com/SJ75s846ju谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Best
#DFIR challenge coin picture 2020! The most deserving duo. Well done. So proud of you.
https://twitter.com/i_am_the_gia/status/1251165192249106432 …
Guess what came in? When in doubt, just ask Siri! We are Lethal Forensicators! Wooohoooo!
Thanks for an awesome class @HeatherMahalik#sans#for585#DFIR#DFIRk9 pic.twitter.com/pnB5mXydbD谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Brigs 转推了
#DailyDFIR 108: Have you wanted to learn mobile forensics, but your excuse was no test data? Not any more!@josh_hickman1 just posted iOS 13 images to go along with his Android ones (& all have detailed documentation!):
https://thebinaryhick.blog/2020/04/16/ios-13-images-images-now-available/ …
https://thebinaryhick.blog/2020/02/15/android-10-image-now-available/ …
#DFIR谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
This is so good. Get them now. iOS
#DFIR images with superb documentation.@josh_hickman1 always spoiling us.https://twitter.com/josh_hickman1/status/1250922279367839745 …
iOS 13 Images....ImageS...Now Available! Yep, you read that right. Images...plural.
#DFIR http://thebinaryhick.blog/2020/04/16/ios-13-images-images-now-available/ … pic.twitter.com/AjuLEAsTG9谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
My new Kizer Sheepdog XL knife:
Ridiculously large
Not too practical
Heavy
Super sharp + smooth deployment
Wouldn't change a thing about itpic.twitter.com/A5SKwFmhI0谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Look at this beauty that just arrived.
@SANSforensics FOR498. Great course that teaches you THE fundamentals. Glad to follow in the tradition of legendary#DFIR Examiners and Master Instructors@KevinRipa &@EricRZimmerman.pic.twitter.com/3XjB14adiU
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Some
#DFIRfit is better than no#DFIRfit. With what is going on in the world we can only take it one step at a time.
pic.twitter.com/MK3PyvKFtL
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Know what data your sources hold and where it could be if it isn't where you expected to be initially.
Don't forget the WAL & Journal files from SQLite databases!https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html …显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
#DFIR reminder: Know your data sources. Android Samsung MyFiles.db.
Metadata from files (traces) recovered not found in the DB due to purposeful deletion.
All the expected metadata (to include source URLs) found in the DB's journal file.显示这个主题帖谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
I couldn't agree more with all of
@melton_tarah's nominations for the#DFIR@4cast awards. Want to highlight even more the following: Jessica Hyde (@B1N2H3X) for mentor of the year. Mike Williamson (@forensicmike1) for newcomer of the year. Me! https://twitter.com/MagnetForensics/status/1249800007538130951 …谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销 -
Not as fancy as
@i_am_the_gia's buckets but combined with stationary
and 
it makes a good combo. #DFIRfit https://twitter.com/i_am_the_gia/status/1249412595481579521 …pic.twitter.com/H225OG5lE6
谢谢。Twitter 会使用此信息，来优化你的时间线。 撤销撤销
加载似乎需要一段时间。
Twitter 可能超载或出现了暂时故障。重试或访问 Twitter 状态以了解更多信息。