SANS Digital Forensics and Incident Response

590 talks · 2014–2025 · indexed by Breach Arc Archive. Links open each talk on YouTube.

• Panel | What’s New in the World of Ransomware in 2025 2025
• Keynote | Adapting Tradecraft: Examining Ransomware Attacks in 2024 - Insights from The DFIR Report 2024
• Evolution of Ransomware Tactics in 2023: Insights from The DFIR Report 2023
• Practical CTI Analysis Over 2023 ITW Linux Implants: Extending Detection Over Blind Spots 2023
• La Evolución del Ransomware: Previsión de Escenarios Posibles para 2022 2022
• La Evolución del Ransomware: Previsión de Escenarios Posibles para 2022 2022
• You Get What You Ask For: Building Intelligent Teams for CTI Success – CTI Summit 2022 2022
• 2021 Forensic 4Cast Awards 2021
• 2021 SANS DFIR Summit Day 1 Wrap Up Panel 2021
• 2021 SANS DFIR Summit Day 2 Wrap Up 2021
• Day 1 Wrap-Up Panel | SANS CTI Summit 2021 2021
• Day 2 Wrap-Up Panel | SANS CTI Summit 2021 2021
• Episode 154: Welcome to 2021 2021
• Incident Response 9-Line | SANS DFIR Summit 2021 2021
• Riding the WAVE to Better Collaboration and Security | SANS CTI Summit 2021 2021
• Ask Us (Almost) Anything About Threat Hunting & Incident Response | 2020 THIR Summit 2020
• Ask Us (Almost) Anything About Threat Hunting & Incident Response | SANS THIR Summit 2020 2020
• Building a Hunting Program at a Global Scale | 2020 Threat Hunting & Incident Response Summit 2020
• Collections and Elections: How The New York Times built an intel collections program in 2020 2020
• Data Science for DFIR - The Force Awakens w/ Jess Garcia - SANS DFIR Summit 2020 2020
• External Threat Hunters are Red Teamers | 2020 Threat hunting & Incident Response Summit 2020
• Extract and Visualize Data from URLs using Unfurl w/ Ryan Benson - SANS DFIR Summit 2020 2020
• Help! We need an adult! Engaging an external IR team w/ Liz Waddell - SANS DFIR Summit 2020 2020
• Hunting bad guys that use TOR in real-time w/ Milind Bhargava - SANS DFIR Summit 2020 2020
• Hunting Human Operated Ransomware Operators | 2020 Threat Hunting & Incident Response Summit 2020
• Hunting Immaturity Model | 2020 Threat Hunting & Incident Response Summit 2020
• If at first you don't succeed, try something else w/ Jim Clausing - SANS DFIR Summit 2020 2020
• Just Forensics, Mercifully w/ Lee Whitfield - SANS DFIR Summit 2020 2020
• Kansa for Enterprise scale Threat Hunting w/ Jon Ketchum - SANS DFIR Summit 2020 2020
• Keynote: Developing Diversity in DFIR w/ Eoghan Casey & Daryl Pfeif - SANS DFIR Summit 2020 2020
• Leveraging Beacon Detection Techniques to Identify Anomalous Logons | 2020 THIR Summit 2020
• Lucky (iOS) #13: Time to Press Your Bets w/ Jared Barnhart - SANS DFIR Summit 2020 2020
• Open NDR and the Great Pendulum | 2020 Threat Hunting & Incident Response Summit 2020
• Raising the Tide: Driving Improvement in Security By Being a Good Human | 2020 THIR Summit 2020
• SaaS Hunting | 2020 Threat Hunting & Incident Response Summit 2020
• The SOC Puzzle: Where Does Threat Hunting Fit? | 2020 Threat Hunting & Incident Response Summit 2020
• Threat Intelligence and the Limits of Malware Analysis with Joe Slowik - SANS CTI Summit 2020 2020
• Using Big DFIR Data in Autopsy and Other Tools w/ Brian Carrier - SANS DFIR Summit 2020 2020
• Using Storytelling to Be Heard and Remembered w/ Frank McClain - SANS DFIR Summit 2020 2020
• A Brief History of Attribution Mistakes - SANS CTI Summit 2019 2019
• AmCache Investigation - SANS Digital Forensics & Incident Response Summit 2019 2019
• Analytic Tradecraft in the Real World - SANS CTI Summit 2019 2019
• ATT&CK™ Your CTI w/ Lessons Learned from 4 Years in the Trenches - SANS CTI Summit 2019 2019
• BEC Revisited: Dropping By on Our Favorite Prince - SANS CTI Summit 2019 2019
• BZAR – Hunting Adversary Behaviors with Zeek and ATT&CK - SANS THIR Summit 2019 2019
• Distributed Evidence Collection and Analysis with Velociraptor - SANS DFIR Summit 2019 2019
• Evolving the Hunt: A Case Study in Improving a Mature Hunt Program - SANS Threat Hunting Summit 2019 2019
• Finding Badness: Using Moloch for DFIR | SANS DFIR Summit 2019 2019
• Forensic Investigation of Emails Altered on the Server | SANS DFIR Summit 2019 2019
• From Tool Building to Scalable Automation - SANS DFIR Summit 2019 Keynote 2019
• Happy Hunting! Lessons in CTI Psychology from TV’s Favorite Serial Killer - SANS CTI Summit 2019 2019
• How to Get Promoted: Developing Metrics to Show How Threat Intel Works - SANS CTI Summit 2019 2019
• How to Use and Create Threat Intelligence in an Office 365 World - SANS CTI Summit 2019 2019
• Hunting Is Sacred, But We Never Do It for Sport! - SANS THIR Summit 2019 2019
• Jupyter Notebooks and Pre-recorded Datasets for Threat Hunting - SANS THIR Summit 2019 2019
• Language and Culture in Threat Intelligence - SANS CTI Summit 2019 2019
• Live Response With Ansible - SANS DFIR Summit 2019 2019
• MacOS DS_Stores: Like Shellbags but for Macs - SANS DFIR Summit 2019 2019
• Meet Me in the Middle: Threat Indications and Warning in Principle & Practice - SANS CTI Summit 2019 2019
• My “Aha!” Moment - Methods, Tips, & Lessons Learned in Threat Hunting - SANS THIR Summit 2019 2019
• Once Upon a Time in the West: A Story on DNS Attacks - SANS THIR Summit 2019 2019
• Privacy vs. Security: It’s a Log Story - SANS CTI 2019 Keynote 2019
• Quality Over Quantity: Determining Your CTI Detection Efficacy - SANS CTI Summit 2019 2019
• Shedding Light on the macOS Spotlight Desktop Search Service - SANS DFIR Summit 2019 2019
• They See Us Rollin’; They Hatin’: Forensics of iOS CarPlay and Android Auto - SANS DIFR Summit 2019 2019
• Tracking Traces of Deleted Applications - SANS DFIR Summit 2019 2019
• Unsolved Mysteries – Revisiting the APT Cold Case Files - SANS CTI Summit 2019 2019
• Untying the Anchor: Countering Unconscious Bias in Threat Intel Analysis - SANS CTI Summit 2019 2019
• #DFIRFIT or Bust! - A Forensic Exploration of iOS Health Data - SANS DFIR Summit 2018 2018
• $SignaturesAreDead = “Long Live RESILIENT Signatures" - SANS DFIR Summit 2018 2018
• A Planned Methodology for Forensically Sound IR in Office 365 - SANS DFIR Summit 2018 2018
• AlphaBay Market: Lessons From Underground Intelligence Analysis - SANS CTI Summit 2018 2018
• Attributing Active Measures, Then and Now - SANS CTI Summit 2018 2018
• Automating Analysis with Multi-Model Avocados - SANS DFIR Summit 2018 2018
• Determining the Fit & Impact of CTI Indicators on Your Monitoring Pipeline - SANS CTI Summit 2018 2018
• Differentiating Evil from Benign in the Normally Abnormal World - SANS Threat Hunting Summit 2018 2018
• Digital Forensics Truths That Turn Out To Be Wrong - SANS DFIR Summit 2018 2018
• DNSplice: A New Tool to Deal with Those Super Ugly Microsoft DNS Logs - SANS DFIR Summit 2018 2018
• Efficiently Summarizing Web Browsing Activity - SANS DFIR Summit 2018 2018
• ElasticIntel: Building an Open-Source Threat Intel Aggregation Platform - SANS CTI Summit 2018 2018
• Event Threat Assessments: G20 Case Study for Improved Security - SANS CTI Summit 2018 2018
• Every Step You Take: Application and Network Usage in Android - SANS DFIR Summit 2018 2018
• Evidence Generation X - SANS DFIR Summit 2018 2018
• Finding and Decoding Malicious Powershell Scripts - SANS DFIR Summit 2018 2018
• Finding the Balance in Security Automation - SANS Threat Hunting Summit 2018 2018
• Homemade Ramen & Threat Intelligence: A Recipe for Both - SANS CTI Summit 2018 2018
• How to Submit a Threat Profile to MITRE ATT&CK - SANS Threat Hunting Summit 2018 2018
• Hunting Hidden Empires with TLS - Certified Hypotheses - SANS Cyber Threat Intelligence Summit 2018 2018
• Hunting Webshells: Tracking TwoFace - SANS Threat Hunting Summit 2018 2018
• I Can Haz Requirements?: Requirements and CTI Program Success - SANS CTI Summit 2018 2018
• Information Anarchy: A Survival Guide for the Misinformation Age - SANS CTI Summit 2018 2018
• Intelligence Preparation of the Cyber Environment - SANS Cyber Threat Intelligence Summit 2018 2018
• Intelligent Hunting: Using Threat Intelligence to Guide Your Hunts - SANS CTI Summit 2018 2018
• Investigating Rebel Scum’s Google Home Data - SANS DFIR Summit 2018 2018
• Lean Hunting - SANS Threat Hunting Summit 2018 2018
• Legal Implications of Threat Intelligence Sharing - SANS CTI Summit 2018 2018
• Leveraging Curiosity to Enhance Analytic Technique - SANS Cyber Threat Intelligence Summit 2018 2018
• Leveraging Data Science to Discover Persistent Threats - SANS Threat Hunting Summit 2018 2018
• Living in the Shadow of the Shadow Brokers - SANS DFIR Summit 2018 2018
• Logging, Monitoring, and Alerting in AWS (The TL;DR) - SANS DFIR Summit 2018 2018
• Mac_apt –The Smarter and Faster Approach to macOS Processing - SANS DFIR Summit 2018 2018
• Quantify Your Hunt: Not Your Parents’ Red Team - SANS Threat Hunting Summit 2018 2018
• Survival Heuristics: My Favorite Techniques for Avoiding Intelligence Traps - SANS CTI Summit 2018 2018
• The Challenge of Adversary Intent and Deriving Value Out of It - SANS CTI Summit 2018 2018
• There Is MOAR To Structured Analytic Techniques Than Just ACH! - SANS CTI Summit 2018 2018
• Threat Hunting Using Live Box Forensics - SANS Threat Hunting Summit 2018 2018
• Uncovering and Visualizing Malicious Infrastructure - SANS Threat Hunting Summit 2018 2018
• Upgrading Your CTI to Track Down Criminal Hosting Infrastructures - SANS CTI Summit 2018 2018
• Who Done It: Gaining Visibility and Accountability in the Cloud - SANS Threat Hunting Summit 2018 2018
• Windows Forensics: Event Trace Logs - SANS DFIR Summit 2018 2018
• Accurate Thinking: Analytic Pitfalls and How to Avoid Them - CTI SUMMIT 2017 2017
• Beats & Bytes: Striking the Right Chord in Digital Forensics - SANS DFIR Summit 2017 2017
• Beyond Matching: Applying Data Science Techniques to IOC-Based Detection - CTI SUMMIT 2017 2017
• Boot What? Why Tech Invented by IBM in 1983 is Still Relevant Today - SANS DFIR Summit 2017 2017
• Conventional Intelligence Analysis in Cyber Threat Intelligence - CTI Summit 2017 2017
• Deciphering Browser Hieroglyphics - SANS Digital Forensics and Incident Response Summit 2017 2017
• Effective Threat Intel Management - CTI SUMMIT 2017 2017
• EXT File System Recovery - SANS Digital Forensics and Incident Response Summit 2017 2017
• Forensic 4cast Awards - SANS Digital Forensics & Incident Response Summit 2017 2017
• Framing Threat Hunting in the Enterprise - SANS Threat Hunting Summit 2017 2017
• Google Drive Forensics - SANS Digital Forensics and Incident Response Summit 2017 2017
• Hunting on Amazon Web Services (AWS) - SANS Threat Hunting Summit 2017 2017
• Hunting Webshells on Microsoft Exchange Server - SANS Threat Hunting Summit 2017 2017
• Hunting: From Fudd to Terminator - SANS Threat Hunting Summit 2017 2017
• Huntworld - SANS Threat Hunting & Incident Response Summit 2017 2017
• Implications of Firmware Trickery Hard Drives - SANS DFIR Summit 2017 2017
• Incident Response in the Cloud (AWS) - SANS Digital Forensics & Incident Response Summit 2017 2017
• Inglorious Threat Intelligence - SANS CTI Summit 2017 2017
• Integrating Cyber Threat Intelligence using Classic Intel Techniques - CTI SUMMIT 2017 2017
• Japanese Manufacturing, Killer Robots, and Effective Incident Handling - SANS DFIR Summit 2017 2017
• Know Your Creds, or Die Trying - SANS Digital Forensics and Incident Response Summit 2017 2017
• Knowing When to Consume Intelligence and When to Generate It - CTI SUMMIT 2017 2017
• Latest on WannaCry Ransomware - SANS WEBCAST - May 16 2017 2017
• Location-Specific Cyber Risk: Where you are Affects how Badly you’ll be Hacked - CTI SUMMIT 2017 2017
• Mac Forensics: Looking into the Past with FSEvents - SANS DFIR Summit 2017 2017
• MAC Times, Mac Times, and More - SANS Digital Forensics & Incident Response Summit 2017 2017
• Open-Source DFIR Made Easy: The Setup - SANS Digital Forensics & Incident Response Summit 2017 2017
• Pen-To-Paper and The Finished Report: The Key To Generating Threat Intelligence - CTI SUMMIT 2017 2017
• Processing PCI Track Data with CDPO - SANS Digital Forensics & Incident Response Summit 2017 2017
• Pushing the Boundaries of Threat Hunting Automation - SANS Threat Hunting Summit 2017 2017
• Real-Time Threat Hunting - SANS Threat Hunting & Incident Response Summit 2017 2017
• Reversing Threat Intelligence - Fun with Strings in Malware - CTI SUMMIT 2017 2017
• Rob Lee "The Most Lethal Forensicator We Know" Award - SANS DFIR Summit 2017 2017
• Scaling Forensics Isn’t Magic - SANS Digital Forensics & Incident Response Summit 2017 2017
• ShimCache and AmCache enterprise-wide hunting - SANS Threat Hunting Summit 2017 2017
• So Many Ducks, So Little Time - SANS Threat Hunting Summit 2017 2017
• Sorry, but There Is No Magic Fairy Dust - SANS Threat Hunting Summit 2017 2017
• Taking Hunting to the Next Level: Hunting in Memory - SANS Threat Hunting Summit 2017 2017
• The Audit Log Was Cleared - SANS Digital Forensics and Incident Response Summit 2017 2017
• The Cider Press: Extracting Forensic Artifacts from Apple Continuity - SANS DFIR Summit 2017 2017
• The Forensics of Plagiarism: A Case Study in Cheating - SANS DFIR Summit 2017 2017
• The Mind of a Hunter: A Cognitive, Data-Driven Approach - SANS Threat Hunting Summit 2017 2017
• The Myth of Automated Hunting in ICS/SCADA Networks - SANS Threat Hunting Summit 2017 2017
• The Secret History of Cyber War - SANS Digital Forensics and Incident Response Summit 2017 2017
• The Threat Intel Victory Garden: Threat Intelligence Using Open Source Tools - CTI SUMMIT 2017 2017
• Threat Hunting in Security Operation - SANS Threat Hunting Summit 2017 2017
• Threat Hunting with Network Flow - SANS Threat Hunting Summit 2017 2017
• Threat Intelligence At Microsoft: A Look Inside - Cyber Threat Intelligence Summit 2017 2017
• Toppling the Stack: Outlier Detection for Threat Hunters - SANS Threat Hunting Summit 2017 2017
• Tracking Bitcoin Transactions on the Blockchain - SANS DFIR Summit 2017 2017
• Using CTI Against the World's Most Successful Email Scam - CTI SUMMIT 2017 2017
• Using Intelligence to Heighten your Defense - CTI SUMMIT 2017 2017
• Wave Your False Flags! Deception Tactics Muddying Attribution - CTI Summit 2017 2017
• What's new in the FOR610: Reverse-Engineering Malware Analysis course in 2017 2017
• A Longitudinal Study of the Little Endian that Could: Threat Hunting Summit 2016 2016
• All About That (Data)Base - SANS DFIR Summit 2016 2016
• APT HUNTER - Threat Hunting Summit 2016 2016
• Casting A Big Net: Hunting Threats at Scale: Threat Hunting Summit 2016 2016
• Defending a Cloud - SANS DFIR Summit 2016 2016
• Deleted Evidence: Fill in the Map to Luke Skywalker - SANS DFIR Summit 2016 2016
• DFIR Summit 2016: Potential for False Flag Operations in the DNC Hack 2016
• DFIR Summit 2016: Incident Detection and Hunting at Scale: An Introduction to Osquery 2016
• DFIR Summit 2016: Leveraging Cyber Threat Intelligence in an Active Cyber Defense 2016
• DFIR Summit 2016: Plumbing the Depths - Windows Registry Internals 2016
• Dive into DSL: Digital Response Analysis with Elasticsearch - SANS DFIR Summit 2016 2016
• DIY DNS DFIR: You’re Doing it WRONG: Threat Hunting Summit 2016 2016
• Expanding The Hunt: A Case Study in Pivoting Using Passive DNS and Full PCAP - SANS DFIR Summit 2016 2016
• FLOSS Every Day: Automatically Extracting Obfuscated Strings from Malware- SANS DFIR Summit 2016 2016
• Hadoop Forensics - SANS DFIR Summit 2016 2016
• How to Rebuild a Security Program Gone Wrong… - SANS DFIR Summit 2016 2016
• Hunting and Dissecting the Weevely Web Shell - Threat Hunting Summit 2016 2016
• Hunting for IOCs with Gusto and Style!: Threat Hunting Summit 2016 2016
• iOS of Sauron: How iOS Tracks Everything You Do- SANS DFIR Summit 2016 2016
• Must Collect IOCs... Now What?! - Threat Hunting Summit 2016 2016
• Must Collect IOCs... Now What?!: Threat Hunting Summit 2016 2016
• Proactive APT Hunting Style: Threat Hunting Summit 2016 2016
• Rocking your Windows EventID with ELK Stack - SANS DFIR Summit 2016 2016
• Seeing Red: Improving Blue Teams with Red Teaming - SANS DFIR Summit 2016 2016
• Start-Process PowerShell: Get Forensic Artifact- SANS DFIR Summit 2016 2016
• The Incident Response Playbook for Android and iOS - SANS DFIR Summit 2016 2016
• The Revolution in Private Sector Intelligence | CTI Summit 2016 2016
• Threat Hunting on the Cheap: Threat Hunting Summit 2016 2016
• Tracking Threat Actors through YARA Rules and Virus Total - SANS DFIR Summit 2016 2016
• Train Like You Fight - Threat Hunting Summit 2016 2016
• Trust but Verify: Why, When and How - SANS DFIR Summit 2016 2016
• UAV Forensic Analysis – Next Gen - SANS DFIR Summit 2016 2016
• Using Endpoint Telemetry to Accelerate the Baseline - SANS DFIR Summit 2016 2016
• Using Open Tools to Convert Threat Intelligence into Practical Defenses: Threat Hunting Summit 2016 2016
• What Does my SOC Do?: A Framework for Defining an InfoSec Ops Strategy - SANS DFIR Summit 2016 2016
• Who Watches the Smart Watches? - SANS DFIR Summit 2016 2016
• You Don’t Know Jack About .bash_history - SANS DFIR Summit 2016 2016
• Crisis Communication for Incident Response - SANS DFIR Summit 2015 2015
• Customized Google Chrome Forensics with Python - DFIR Summit 2015 2015
• Determining Files and Folders Accessed in OS X - SANS DFIR Summit 2015 2015
• Digital Forensics: The Human Cost - DFIR Summit 2015 2015
• DNS queries - Walk Softly and Carry 26 Trillion Sticks - DFIR Summit 2015 2015
• Forensic Analysis of sUAS aka Drones - SANS DFIR Summit 2015 2015
• Hardware Keylogger Case Study - SANS DFIR Summit 2015 2015
• In the Lair of the Beholder: Extrusion Detection in 2015 - SANS DFIR Summit 2015 2015
• Investigation and Intelligence Framework - DFIR Summit 2015 2015
• MIG: Mozilla’s Distributed Platform for Real-Time Forensics of Endpoints - SANS DFIR Summit 2015 2015
• NoSQL Forensics: What to Do with (No)ARTIFACTS - DFIR Summit 2015 2015
• Power(Shelling) Through the Timeline - SANS DFIR Summit 2015 2015
• There’s Something About WMI - DFIR Summit 2015 2015
• Think Again: Are We Doing it Wrong? - DFIR Summit 2015 2015
• Threat Analysis of Complex Attacks - DFIR Summit 2015 2015
• Towards Forensicator Pro - FATE - DFIR Summit 2015 2015
• Ubiquity Forensics – Your iCloud and You - DFIR Summit 2015 2015
• Windows 8 SRUM Forensics - SANS DFIR Summit 2015 2015
• Windows Phone 8 Forensic Artifacts and Case Study - DFIR Summit 2015 2015
• 10 Ways to Rock Your SOC - SANS DFIR Summit 2014 2014
• DFIR Summit 2014 Keynote: Barbarians at Every Gate: Responding to a Determined Adversary 2014
• SANS DFIR Webcast - Cyber Threat Intelligence Summit 2014 2014
• (Am)Cache rules everything around me
• 3 Min Max - Episode 116: Size vs Size on Disk-Part 4
• 3MinMax - Episode 142: Encryption - Part 18 - Diffie Hellman Key Exchange 1
• 3MinMax - Episode 144: Encryption - Part 20 - Diffie Hellman Key Exchange 3
• [JP] RaaS: Evolution, Implications and Countermeasures
• A Ghidra Test Drive
• A glimpse of the NEW FOR585 Advanced Smartphone Course
• A Guide to Eric Zimmerman's command line tools (EZ Tools)
• A Technical Autopsy of the Apple - FBI Debate using iPhone forensics | SANS DFIR Webcast
• Advanced Zeek Usage Scripting and Framework
• Analyzing User Mode Dumps With WinDbg
• Are You Ready for Threat Intelligence: Behind the Scenes with FOR578
• Behind The Scenes Of Law Enforcement And Private Industry Cooperation | STAR Webcast
• Beyond the FOMO: Expanding Horizons for Cyber Threat Intelligence Analysts
• Building a House on Sand – Why Foundational Knowledge and Skills in Digital Forensics are Crucial
• Building your Android Application Testing Toolbox
• Business Email Compromise; Office 365 Making Sense of All the Noise
• Cleveland Clinic Best Practices On Securing Unmanaged and IoT Devices
• Cloud Storage Forensics Endpoint Evidence
• Collecting and Hunting for Indications of Compromise with Gusto and Style! - Threat Hunting
• Critical Citrix Vulnerability - SANS Webcast w/ Johannes B. Ullrich, Ph.D., Dean of Research
• Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think!
• Detecting & Responding to Pandas and Bears:
• DNS Evidence You Don’t Know What You’re Missing
• Elevating Your Analysis Tactics with the DFIR Network Forensics Poster
• Enabling KAPE at Scale
• Encuentros de dia cero: Relatos desde la trinchera
• Episode 100: The 100th Episode!!!
• Episode 101: USB Forensics Series - Part 3 of 7
• Episode 102: USB Forensics Series - Part 4 of 7
• Episode 103: USB Forensics Series - Part 5 of 7
• Episode 104: USB Forensics Series - Part 6 of 7
• Episode 105: USB Forensics Series - Part 7 of 7
• Episode 106: The TWO Serial Numbers of a USB Device - Part 1 - 3 Min Max Series
• Episode 107: The TWO Serial Numbers of a USB Device - Part 2
• Episode 108: The TWO Serial Numbers of a USB Device - Part 3
• Episode 109: The TWO Serial Numbers of a USB Device - Part 4
• Episode 10: Checking for disk encryption prior to imaging
• Episode 110: The Volume Serial Number
• Episode 111: The difference between 'possible' and 'probable'.
• Episode 112: Who Supports You?
• Episode 113: Size vs Size on Disk-Part 1
• Episode 114: Size vs Size on Disk-Part 2
• Episode 115: Size vs Size on Disk-Part 3
• Episode 117: Don't Assume I Know What You Know
• Episode 118: Weird Keyboard Characters
• Episode 119: Artifacts Are Not There for You
• Episode 11: What does “forensically sound” actually mean? Part 1
• Episode 120: Registry Write Blocking - Part 1
• Episode 121: Registry Write Blocking - Part 2
• Episode 122: Registry Write Blocking - Part 3
• Episode 123: Registry Write Blocking - Part 4
• Episode 124: How We Get Good
• Episode 125: Encryption & Crypto - Part 1
• Episode 126: Encryption - Part 2
• Episode 127: Encryption - Part 3
• Episode 128: Encryption - Part 4
• Episode 129: Encryption - Part 5
• Episode 12: What does "Forensically Sound" Actually Mean? Part 2
• Episode 130: Encryption - Part 6 - Hashing
• Episode 131: Encrytion - Part 7 - HashingII
• Episode 132: Encryption - Part 8
• Episode 133: Encryption - Part 9
• Episode 134: Encryption - Part 10
• Episode 135: Encryption - Part 11
• Episode 136: Encryption - Part 12
• Episode 137: Encryption - Part 13 - Confidentiality
• Episode 138: Encryption - Part 14 - Integrity
• Episode 139: Encryption - Part 15 - Authentication
• Episode 13: What are the top 5 “Quick Win” files in Battlefield Forensics?
• Episode 140: Encryption - Part 16 - Non Repudiation
• Episode 141: Encryption - Part 17 - Full Encryption Circle
• Episode 143: Encryption - Part 19 - Diffie Hellman Key Exchange 2
• Episode 145: Encryption - Part 21 - Diffie Hellman Alternate Depiction
• Episode 146: RAM Collection Conundrum
• Episode 147: Keep Your Forensic Computer Clean
• Episode 148: Story Time 1 - Part 1
• Episode 149: Story Time 1 - Part 2
• Episode 14: “Quick Win” files #1 - The Registry-Part 1
• Episode 150: Story Time 2
• Episode 151: Story Time 3
• Episode 152: Apple Acquisition - Non T2 Security Chip
• Episode 153: Apple Acquisition - T2 Security Chip
• Episode 155: IPv4 - Part 1
• Episode 156: IPv4 - Part 2
• Episode 157: IPv4 - Part 3
• Episode 158: IPv4 - Part 4
• Episode 159: IPv6 - Part 1
• Episode 15: “Quick Win” files #1 - The Registry-Part 2
• Episode 160: IPv6 - Part 2
• Episode 161: Interesting IPv4 Statistics
• Episode 162: Introduction to Apple Forensics
• Episode 163: Apple User Logon & File Vault
• Episode 164: Collecting Machine Info on Mac - Part 1
• Episode 165: Collecting Machine Info on Mac - Part 2
• Episode 166: Collecting Machine Config on Mac - Part 3
• Episode 168: Apple Forensics: Magic Keystrokes - alt/option key
• Episode 169: Apple Forensics: Magic Keystrokes - Single User Mode key
• Episode 16: “Quick Win” files #2 - Jumplists-Part 1
• Episode 170: Apple Forensics: Magic Keystrokes - Recovery Mode key
• Episode 171: Apple Forensics: Magic Keystrokes - Target Disk Mode key
• Episode 172: Apple Security: The Firmware Password
• Episode 173: Apple Security: Gatekeeper
• Episode 174: Apple Security: System Integrity Protection
• Episode 175: Digital Acquisition & Selecting Destination Media
• Episode 176: Apple Device Tooling
• Episode 177: Tools & Techniques: Opening an iPhone
• Episode 178: Tools & Techniques: Opening an iPad
• Episode 179: Tools & Techniques: Opening a MacBook Device
• Episode 17: “Quick Win” files #2 - Jumplists-Part 2
• Episode 180: Introducing FOR498A Forensic Data Acquisition
• Episode 181: When Forensicators Screw Up - Part 1
• Episode 182: When Forensicators Screw Up - Part 2
• Episode 183: When Forensicators Screw Up - Part 3
• Episode 184: When Forensicators Screw Up - Part 4
• Episode 185: When to Stop Looking for Evidence - Part 1
• Episode 186: When to Stop Looking for Evidence - Part 2
• Episode 187: When to Stop Looking for Evidence - Part 3
• Episode 188: When to Stop Looking for Evidence - Part 4
• Episode 189: Formatting a Drive as HFS+
• Episode 18: Setting CLI tools to run from any path in Windows 10
• Episode 190: Forensic 4Cast Awards
• Episode 192: Fixing the Internet - Feedback Responses 1
• Episode 193: Fixing the Internet - Feedback Responses 2
• Episode 194: Apple RAM Acquisition - Part 1
• Episode 195: Apple RAM Acquisition - Part 2
• Episode 196: Apple RAM Acquisition - Part 3
• Episode 197: Apple RAM Acquisition - Part 4
• Episode 198: Analyzing Mac RAM in AXIOM
• Episode 199: Analyzing Mac RAM in AXIOM (Collected with MacQuisition)
• Episode 19: “Quick Win” files #3 - .LNK files-Part 1
• Episode 1: Let's learn in bite sized chunks - 3MinMax Series is born!
• Episode 20: “Quick Win” files #3 - .LNK files-Part 2
• Episode 21: “Quick Win” files #4 - Shellbags-Part 1
• Episode 22: “Quick Win” files #4 - Shellbags-Part 2
• Episode 23: “Quick Win” files #5 - Prefetch-Part 1
• Episode 24: “Quick Win” files #5 - Prefetch-Part 2
• Episode 25: Bigger data storage containers
• Episode 26: Bigger data storage - RAID 0
• Episode 27: Bigger data storage - RAID 1
• Episode 28: Bigger data storage - RAID 5
• Episode 29: Bigger data storage - Protections
• Episode 2: FOR498: Battlefield Forensics & Data Acquisition Q&A session
• Episode 30: What you do affects lives. Act like it
• Episode 31: Mistakes in online evidence collection
• Episode 32: No, you didn’t trace that IP to a computer at this address…
• Episode 33: How the heck do I image a Surface Pro?
• Episode 34: What is the defense expert’s role - Intro
• Episode 35: What is the defense expert’s role - Part 1
• Episode 36: What is the defense expert’s role - Part 2
• Episode 37: What is the defense expert’s role - Part 3
• Episode 38: What is the defense expert’s role - Part 4
• Episode 39: What is the defense expert’s role - Part 5
• Episode 3: Laying out the steps adversaries take to compromise your system
• Episode 40: What is best evidence?
• Episode 41:Two types of witnesses
• Episode 42: Do you know what that web page is serving?
• Episode 43: Peculiarities of imaging a solid state drive
• Episode 44: Event Log Forensic Goodness
• Episode 45: Logon/Log Off Event Logs
• Episode 46: Wireless Networks Event Logs
• Episode 47: Oalerts Event Logs
• Episode 48: Remote Desktop Protocol Event Logs
• Episode 49: Detecting Time Manipulation
• Episode 4: Your users are the reason you have a job. Stop picking on them!
• Episode 50: Lies my computer told me…
• Episode 51: Lies My Computer Told Me-LNK Files
• Episode 52: The invisible files - Jumplists
• Episode 53: Volume Shadow Copy-Part 1
• Episode 54: Volume Shadow Copy-Part 2
• Episode 55: Volume Shadow Copy-Part 3
• Episode 56: They hid their data in webcache! Part 1
• Episode 57: They hid their data in webcache! Part 2
• Episode 58: Cellphone seizure process
• Episode 59: My iPhone is hacked!
• Episode 5: Beware the "Perfect Solution Fallacy"
• Episode 60: How passwords get hacked
• Episode 61: Selecting a bulletproof password
• Episode 62: Creating wordlists for password cracking
• Episode 63: Using a Password Manager - Part 1
• Episode 64: Using a Password Manager - Part 2
• Episode 65: Understanding Computer Data
• Episode 66: Bits
• Episode 67: Bytes
• Episode 68: Why are there so many different ways to represent data?
• Episode 69: Understanding the Nibble in binary data.
• Episode 6: Order of Volatility
• Episode 70: This video is a description of Hexadecimal data.
• Episode 71: How do I convert hexadecimal to decimal?
• Episode 72: This episode will define Endian, and what it means to computer data.
• Episode 73: What is the ASCII Table?
• Episode 74: How to Get Started in Digital Forensics
• Episode 75: What is the Windows Registry?
• Episode 76: Investigating the Windows Registry using Registry Explorer - Part 1
• Episode 77: Investigating the Windows Registry using Registry Explorer - Part 2
• Episode 78: What is the Windows Registry transaction log?
• Episode 79: Stop Beating up on Free Tools!
• Episode 7: Order of Volatility Part 2
• Episode 80: Learning about the KAPE tool.
• Episode 81: Understanding and Using KAPE Target Files
• Episode 82: Understanding and Using KAPE Module Files
• Episode 83: Explaining the KAPE GUI Version -Target Side
• Episode 84: Explaining the KAPE GUI Version - Module Side
• Episode 85: Running KAPE through the GUI Version
• Episode 86: Reviewing the Output Created by KAPE
• Episode 87: Introducing and Using Timeline Explorer
• Episode 88: Comparing EZViewer to Other Free File Viewers
• Episode 89: Finding Forensic Badness in 3 Minutes or Less
• Episode 8: What is the effect on RAM of imaging the RAM?
• Episode 90: Computers and the Internet can be a Wasteland of Evil
• Episode 91: Case study on an incorrect conclusion in a criminal case-Part 1
• Episode 92: Case study on an incorrect conclusion in a criminal case-Part 2
• Episode 93: Case study on an incorrect conclusion in a criminal case-Part 3
• Episode 94: The Internet is Broken. Let's Fix It - Part 1
• Episode 95: The Internet is Broken. Let's Fix It - Part 2
• Episode 96: The Internet is Broken. Let's Fix It - Part 3
• Episode 97: Introducing the USB Forensics Series
• Episode 98: USB Forensics Series - Part 1 of 7
• Episode 99: USB Forensics Series - Part 2 of 7
• Episode 9: When WOULDN'T you acquire the RAM?
• Exploring Registry Explorer
• Fast, Scalable Results with EZ Tools and the New Command line poster
• FOR498 - New Course Name, New Content & A Whole Lot of Actionable Intelligence in 90 min or less
• FOR498A: Forensic Data Acquisition Stay Sharp course | Interview with Kevin Ripa
• FOR508 - Advanced Incident Response and Threat Hunting Course Updates: Hunting Guide
• FOR528: Ransomware & Cyber Extortion Course Overview
• FOR528: Ransomware & Cyber Extortion Course | SANS
• FOR572 Class Demo - vLive
• FOR572 Course Update from the Future: Where We’re Going, We Don’t Need Roads
• FOR572: Always Updating, Never at Rest
• FOR578 Cyber Threat Intelligence Course Update - 6th day
• FOR578: Cyber Threat Intelligence Course Overview
• FOR585 Course Animation: Potential Crime Scene iPhone and Android
• FOR585 Course Animation: How WAL Gets Populated Initial State
• FOR585 Course Animation: IMEI vs GSM
• FOR585 Course Animation: Solid State Memory Properties
• FOR585: Smartphone Forensic Analysis In-Depth course overview
• FOR585A: iOS Forensic Analysis Stay Sharp course | Interview with Domenica "Lee" Crognale
• FOR589: Cybercrime Intelligence Overview
• FOR610 Course - Reverse-Engineering Malware: Malware Analysis Tools and Techniques
• FOR610A: Introduction to Malware Analysis Stay Sharp course | Interview with Lenny Zeltser
• From Seizure to Actionable Intelligence in 90 Minutes or Less
• Getting started in DFIR: Testing 1,2,3
• Getting started in DFIR: Testing 1,2,3 | Phill Moore
• Getting Started with the SIFT Workstation Webcast with Rob Lee
• Ghidra Code Analysis with Anuj Soni
• Handling Ransomware Incidents: What YOU Need to Know!
• Herramientas rapidas DFIR para respuesta a incidentes y caza de amenazas Parte Deux
• Herramientas rápidas DFIR para respuesta a incidents y caza de amenazas
• How to Effectively Investigate a Human-Operated Ransomware Attack
• How to Intercept IP Connections in a Malware Analysis Lab
• Hunting Cyber Threat Actors with TLS Certificates
• I Knew You Were Trouble – Detecting Threat Actors Before They Deploy Ransomware
• Interested in Smartphone Forensics?
• Intro to Shellcode Analysis: Tools and Techniques
• Introducing the New SANS DFIR “Hunt Evil“ Poster
• Introduction to Arsenal Image Mounter
• Introduction to KAPE
• Investigating WMI Attacks
• iOS 11 isn' t all fun and games
• iOS Location Forensics
• iOS Third Party Apps Analysis how to use the new reference guide poster
• iOS Third Party Apps Analysis how to use the new reference guide poster
• Leveraging Cyber Threat Intelligence
• LOCKED OUT! Detecting, Preventing, & Reacting to Human Operated Ransomware
• Making Order out of Chaos: How to Deal with Threat Group Names | STAR Webcast
• Malware Analysis Course FOR610 Introduction by Lenny Zeltser
• Malware Blocks - SANS DFIR SUMMIT
• Meltdown and Spectre - Updated Threat Information - Latest Information - SANS DFIR WEBCASTS
• Meltdown and Spectre - Understanding and mitigating the threats - SANS DFIR Webcast
• Memory Forensics Acquisition Cloud
• Memory Forensics: How we used to do it & how we use it to respond to large-scale breaches today
• Mobile Validation - Working together for the Common Good
• Network Disasters: Incident Response When the Bits Hit the Fan - SANS DFIR SUMMIT
• Next Level in Cyber Threat Intelligence Training: New FOR578 course updates
• No tool fits all – Why Building a solid Toolbox Matters
• Panic! Hysteria! No malware required!
• Performing Smartphone Forensics without Commercial Tools - SANS DFIR SUMMIT
• Plumbing the Depths: ShellBags - SANS DFIR SUMMIT
• Prevent, Detect, Respond An Intro to Google Workspace Security and Incident Response
• Ready Forensicator One
• Rob Lee Discusses The OPM.GOV Hack on CNN
• Rob T. Lee - Could LockBit, ransomware provider have been behind Lurie hack?
• Rob T. Lee - Federal officials warn of attacks on water utilities
• Rob T. Lee Chicago's Lurie Children's Hospital RANSOMWARE ATTACK
• SANS DFIR WebCast - Virtualization Incident Response & Forensics:
• SANS DFIR Webcast - What's New in REMnux v4 for Malware Analysis?
• SANS DFIR WEBCAST - 50 Shades of Hidden - Diving deep into code injection -
• SANS DFIR Webcast - Anti anti forensics in action Recovering from USB oblivion
• SANS DFIR Webcast - APT Investigations -- How To The Forensic Side
• SANS DFIR Webcast - Closing the Door on Web Shells
• SANS DFIR Webcast - Detecting Evil on Windows Systems - An In Depth Look at the DFIR Poster
• SANS DFIR Webcast - FOR585 Advanced Smartphone and Mobile Device Forensics Preview Android vs iOS
• SANS DFIR WEBCAST - How memory forensics will help you lose weight and look ten years younger
• SANS DFIR Webcast - Incident Response Event Log Analysis
• SANS DFIR WebCast - Introduction to Windows Memory Analysis
• SANS DFIR Webcast - IP Theft Collecting Artifact Evidence from the Cloud and Mobile
• SANS DFIR WEBCAST - Knock off Phone Forensics Some handsets Aren't What They Appear To Be
• SANS DFIR Webcast - Memory Forensics for Incident Response
• SANS DFIR Webcast - Mobile Device Forensics
• SANS DFIR WEBCAST - Network Forensics What Are Your Investigations Missing
• SANS DFIR WEBCAST - Protecting Privileged Domain Accounts during Live Response -
• SANS DFIR Webcast - Reverse Engineering Mac Malware
• SANS DFIR Webcast - State of Cyber Threat Intelligence Address
• SANS DFIR WebCast - Super Timeline Analysis
• SANS DFIR Webcast - When Macs get Hacked
• SANS DFIR Webcast -- Cache Me If You Can!
• SANS DFIR Webcast -- DFIR using SIFT Workstation
• SANS DFIR Webcast -- You can panic now Host Protection is mostly dead
• SANS DFIR Webcast | Hands on USN Journal Analysis
• SANS DFIR Webcast: Privileged Domain Account Protection How to Limit Credentials Exposure
• SANS DFIR WEBCAST: Smartphone Forensics Moves Fast. Stay Current or You May Miss Relevant Evidence!
• SANS DFIR Webcast: Smartphone Security is Getting Stronger Are Your Forensic Methods Getting Weaker
• SANS DFIR Webcast: The Crazy New World of Cyber Investigations Law, Ethics, and Evidence
• SANS DFIR WEBCASTS - Analysis and Correlation of Macintosh Logs
• SANS Law Enforcement Appreciation Programs
• Securing Your Future in DFIR
• Shortcuts for Understanding Malicious Scripts
• Skip This Webinar - It's Just Everything You Need To Know About Smartphones
• Smartphone Forensics Investigations: Two major plists
• Smartphone Forensics Investigations: An Overview of Third Party App Examination
• Smartphone Forensics Investigations: iOS Malware - Where to begin
• Smartphone Forensics Investigations: Using HashCat to Crack an Encrypted iTunes Backup
• Smartphone Forensics Investigations: What if nothing supports Android Pie (v9)
• Smartphone Forensics Investigations: Why Every Examiner Needs a Test Device?
• SOF ELK® A Free, Scalable Analysis Platform for Forensic, Incident Response, and Security Operation
• SPECIAL SANS WEBCAST: What you need to know about the Crypt32.dll / CryptoAPI Flaw
• STAR Webcast: Threat Hunting and the Rise of Targeted eCrime Intrusions
• STAR Webcast: Becoming the Adversary: Creating a Defensive Lab to Understand the Offense
• STAR Webcast: Dissecting BadBlood: an Iranian APT Campaign
• STAR Webcast: Making sense of SolarWinds through the lens of MITRE ATT&CK(R)
• STAR Webcast: Spooky RYUKy: The Return of UNC1878
• State of the Cyber Threat Intelligence Address - SANS CTI Summit
• Stay Ahead of Ransomware: Building an AI-Powered Ransomware Intelligence Agent
• The Cycle of Cyber Threat Intelligence
• The Magic of Raw Data Carving
• The State of Malware Analysis: Advice from the Trenches
• The Truth about Ransomware: Its not Complicated!
• There's Gold in them thar package management database with Phil Hagen
• Think DFIRently: What is Digital Forensics & Incident Response (DFIR)?
• Thinking DFIRently From Entry to Specialty
• Threat Intelligence Naming Conventions: Threat Actors, & Other Ways of Tracking Threats
• To Automate or Not To Automate: That is the Incident Response Question
• To trust or not to trust: The relationship between you your mobile forensics tools
• Triage Collection and Timeline Analysis with KAPE
• Unbreak my Heart – Lessons learned for building better medical devices while troubleshooting my pace
• Unbreak my Heart – Lethal Forensicating Saves Lives
• Understanding SANS CyberCast So Much More Than Live Virtual Training
• Understanding the Forensic Science in Digital Forensics
• Updated FOR578: Training for Security Personnel and Why Intelligence Matters to You
• Upgrading Cloud Forensics with FOR509
• WannaCry Ransomware Threat : What we know so far - SANS WEBCAST
• WEBCAST SERIES: SO, YOU HAVE TO TESTIFY, NOW WHAT (PART 1)
• What Event Logs Part 2 Lateral Movement without Event Logs
• What Event Logs? Part 1: Attacker Tricks to Remove Event Logs
• What is new in SANS FOR585: Smartphone Forensic Analysis In-Depth
• What is the FOR528: Ransomware for Incident Responders course all about?
• What makes a solid DFIR professional – How to keep growing in the field and not lose your luster
• What’s new in FOR572: Advanced Network Forensics - Threat Hunting, Analysis, and Incident Response
• What’s New in REMnux v7
• What’s New with FOR518 Mac and iOS Forensic Analysis & Incident Response
• When your forensic tool only tells part of the story finding code injection using memory analysis
• Why and How to Take the GCTI The Industry’s Cyber Threat Intelligence Certification
• Why take FOR578 OnDemand? with Robert M. Lee
• Windows Credentials Attacks, Mitigations & Defense
• Wrap Up Panel
• 意外と簡単なランサムウェア運用ツールの検出と駆逐