-1
votes
1answer
371 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
3
votes
2answers
940 views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...
4
votes
5answers
331 views

Tool to grab sensitive information from command lines

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
4
votes
1answer
178 views

Data analyzer tools

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
8
votes
3answers
1k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
0
votes
2answers
262 views

is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?

Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation Like Niksun or Solera solution do ? I'm ...
14
votes
2answers
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?