Subscribe to Windowsir’s news feed.
Click on “Follow” and decide if you want to get news from Windowsir via RSS, as email newsletter, via mobile or on your personal news page.
Subscription to Windowsir comes without risk as you can unsubscribe instantly at any time.
You can also filter the feed to your needs via topics and keywords so that you only receive the news from Windowsir which you are really interested in. Click on the blue “Filter” button below to get started.
Title: Windowsir
Is this your feed? Claim it!
If someone asked me to name the biggest shortcoming in DFIR, and in cybersecurity, in general, I'd have to say documentation.
We miss a lot of value because activity and analysis goes undocumented, and it is lost. Without documentation clearly delineating what was done, and what was observed, we can't identify and address issues that need to be fixed.
Without tha...
Something I've seen consistently, from the very beginning when I first brushed up against this business of "digital forensics", is the default focus on, "...this is how you analyze this artifact...", and rarely extending beyond that.
I'm guilty of this, too. My first 8 books took this approach, listing data sources and artifacts, describing what they were in a general...