This week I talk about an openly available library and tool repository  all examiners should be aware of as well as a tool by Didier Stevens called "AnalyzePESig" which is perfect for bulk analysis of executables on Windows systems.

This week I talk File Use & Knowledge investigations involving virtual machines. This is mainly from a dead-box exam point-of-view.

This week I talk about SRUM, a windows artifact with some significant forensic value for both File Use & Knowledge investigations as well as Incident Response.

This week I talk about considerations for digital evidence integrity when collection evidence on-scene from a live system.

This week I talk about surviving mobile App timestamps.

This week I share my thoughts on setting DFIR goals for the coming year. I go over seven points worth focusing on for professional development.

This week I talk DMA (direct memory access) exploits as a technique to bypass passwords of a live system to conduct imaging - with legal authority of course.

This week I talk about a useful automated file intelligence resource for dead box exam as well as IR investigations.

This week I go over survival tips for imaging a Mac.

This week I about the format change for Windows 10 Prefetch files as well as a freely available tool to decompress and present .pf file data.

This week I'm talking .Trash. I cover the forensic basics of this Mac artifact that examiners need to know.

This week I talk about Mac Log files that are useful for File Use & Knowledge investigations as well as Incident Response.

This week I talk about Apache weblogs and a great resource for foundational knowledge at aid newer examiners with forensic analysis. In addition, big news for the SDF series!

This week it's back to Mac forensics with a look at the the Finder Sidebar and it's value for File Use & Knowledge investigations.

This week I pull back the focus for newer examiners and share some thoughts on creating a system that works for you to organize, and keep readily accessible, all the knowledge you accumulate..... and a few words about Shimcache on Windows 10.

This week I breakdown iCloud forensic artifacts.

This week I talk about where to find different listing of different recently accessed files on a Mac as well as how to break out the data for interpretation.

This week I go over some of my favorite Mac tools.

This week I talk about some common PLISTS to check as part of an initial system triage.

This week I talk about common Mac file formats, Libraries and Keychains.

This week I talk about Mac Home Folders to give Mac Examiners an idea of how it is structured and where to look for certain artifacts.

This week I talk about OS X's Spotlight feature, a powerful indexing and search engine built into your Mac that may be harnessed for computer forensic purposes.

This week I talk Apple double files and what to make of them during a forensic exam.

This week I am taking a breather and doing some planning for future topics. If you have a topic you would like to see covered mention it in the show notes. Full episodes will return the first week of September.

This week I go over some of my top reasons why Macs should be considered as a computer forensic platform.