JK Kim

Malicious PyPI packages that steal cryptocurrency wallet information, blog.plainbit.co.kr/pypi-package-t…

The 6th Digital Forensics Challenge (DFC) has begun. #DFC #DFC2023 dfchallenge.org

DFC2022 has started this year as well. Let's go solve the problem! dfchallenge.org

DFC(Digital Forensics Challenge)2021 started. Great experience, valuable time and improvement of my level dfchallenge.org #DFC2021

@Forensicator4 Hi, Forensicator, I watched your DFC 2020 write-up well. However, since DFC 2020 is currently in progress, evaluation is getting difficult with the write-up you posted. If possible, post a write-up after the competition.

Blog time! This one's a write-up of a CTF that had me digging through NTFS artefacts I don't use every day. It was a real challenge and very enjoyable, made all the more interesting by not having most of my usual tools available bit.ly/31khFIy

The ranking of the @DFC2020 challenge has been updated. dfchallenge.org/ranking-2020/

Digital Forensics Challenge 2020 is finally OPEN! dfchallenge.org #DFC2020

Which dForensic tools are used by professionals? blog.plainbit.co.kr/archives/3142

Check the following registry key for the folder id of Windows Timeline. NTUSER.DAT\Software\Microsoft\Office\<version>\Common\Identity\Identities

@binaryz0ne @EricRZimmerman I'm always using that combination too. But sometimes I need a UI for winprefetchview.

@pr0neer Just parse with PECmd and throw it into TimeLine Explorer also from @EricRZimmerman to keep a GUI flavor :)

Why does winprefetchview still parse format version 26? Please update to support Windows 10 (format version 30). PECmd is great, but it's hard to lose the GUI's comfort. github.com/libyal/libscca…

The boot prefetch is no longer visible in Windows 10. It seems to be the effect of fast startup. Now let's look at bootckcl.etl.

@binaryz0ne Windows 10 Pro ver 1903!

@pr0neer On which system?

The Superfetch service is no longer visible. This service has been replaced by SysMain. The EnablePrefetcher registry value is no longer meaningful.

TaskForce vs. TX1 vs. Forensic Falcon, What would you choose? blog.plainbit.co.kr/archives/2932

Introduction to Atola TaskForce, blog.plainbit.co.kr/archives/2880

DFC 2019's Ranking updated, dfchallenge.org/ranking-2019/

DFC 2019's Ranking updated - 45 days left, dfchallenge.org/ranking-2019/

DFC2019 Ranking Updated, dfchallenge.org/ranking-2019/

Using MITRE ATT&CK for Forensics: WMI Event Subscription (T1084), cyberforensicator.com/2019/07/13/usi…