Not long ago, Florian Roth shared some fascinating thoughts via his post, The Bicycle of the Forensic Analyst, in which he discusses increases in efficiency in the forensic review process. I say “review” here, because “analysis” is a term that is often used incorrectly, but that’s for another time. Specifically, Florian’s post discusses efficiency in the forensic review process during incident response.
After reading Florian’s article, I had some thoughts that I wanted share to that would extend what he’s referring to, in part because I’ve seen, and continue to see the need for something just like what is discussed. I’ve shared my own thoughts on this topic previously.
My initial foray into digital forensics was not terribly different from Florian’s, as he describes in his article. For me, it wasn’t a lab crammed with equipment and two dozen drives, but the image his words create and perhaps even the sense of “where do I start?” was likely similar. At the same time, this was also a very manual process…open images in a viewer, or access data within images via some other means, and begin processing the data. Depending upon the circumstances, we might access and view the original data to verify that it *can* be viewed, and at that point, extract some modicum of data (referred to as “triage data”) to begin the initial parsing and data presentation process before kicking off the full acquisition process. But again, this has often been a very manual process, and even with checklists, it can be tedious, time consuming, and prone to errors.
Over the years, analysts have adopted something similar to what Florian describes, using such tools as Yara, Thor (Lite), log2timeline/plaso, or CyLR. These are all great tools that provide considerable capabilities, making the analyst’s job easier when used appropriately and correctly. I should note that several years ago, extensions for Yara and
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: