Arsenal Recon

Developers of digital forensics weapons which include Arsenal Image Mounter, Hibernation Recon, LevelDB Recon, HBIN Recon, & Registry Recon. Arm Yourself! #DFIR

[Arsenal Recon @ArsenalRecon]

Arm yourself with our tools & eliminate blind spots in digital forensics! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

ARMWinFE & AIM Remote Agent in action!

[Arsenal Recon @ArsenalRecon]

Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

@Craig__Bowling You're welcome! We don't get out of the office very often, but when we do we try to make it worthwhile for everyone... just keep that thing on top of your desk please.

[Arsenal Recon @ArsenalRecon]

Did you know that LevelDB Recon can recover data from partially overwritten (corrupt) LevelDB files? Here’s a short video of LevelDB files being ingested from The TechHive Scenario (a Windows on Arm disk image) & some quick geolocation analysis. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

How do you analyze Windows hibernation? Did you know that Hibernation Recon’s core functionality is free? Here’s a brief demonstration of Hibernation Recon running against The TechHive Scenario, a publicly-accessible Windows on Arm disk image. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

What have your digital forensics instructors told you about the analysis of Windows swap? Have they explained that without the use of Swap Recon you are blind to massive volumes of data? https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

@Craig__Bowling @ArsenalArmed You're in an exclusive club having both of these challenge coins... we hope to see you again soon!

[Arsenal Recon @ArsenalRecon]

Our digital forensics tools have put extremely powerful & fundamentally unique functionality into the hands of our customers for ~15 years. If you're a #DFIR practitioner, it's in your best interest (& those you serve) to be aware of what we're doing! https://t.co/w8v2JqX7rn

[Arsenal Recon @ArsenalRecon]

The new Arsenal Image Mounter includes many Recon Report enhancements. Can you see how the new hardware information might come in useful? https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Did you know that the latest Arsenal Image Mounter exposes BitLocker metadata in Free Mode that is unavailable from manage-bde & elsewhere? Check out these screenshots to see some examples made possible by our new BitLocker library. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Arsenal Image Mounter v3.13.368 just released with even more powerful & unique BitLocker functionality (Free & Professional Modes!) thanks to a new BitLocker library developed by Joakim Schicht & many late nights from Olof Lagerkvist. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

One of our summer interns has been spending a lot of time with LevelDB... here's a couple screenshots of Olek using the new LevelDB Recon to decode a JSON Web Token (JWT) from The TechHive Scenario (a publicly-accessible Windows on Arm disk image). https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Check out LevelDB Recon's new Content Viewer identifying latitude/longitude coordinates in a key/value pair's embedded JSON (within our publicly accessible disk image, The TechHive Scenario) & displaying them on a map. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Just released LevelDB Recon v1.0.0.62 with a new "Content Viewer" that displays embedded data in a more human-friendly manner & much more, see the change log for details! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

The "TechHive Scenario" is a Windows on Arm disk image we made available to the public via NIST CFReDS (https://t.co/wmxr8z8cf7) about a month ago. Have you used it for #DFIR training or R&D? We just used it for LevelDB Recon R&D, here's a couple internal build screenshots.

[Arsenal Recon @ArsenalRecon]

Have you thought about how Hibernation Recon could be used to gain new insight into your highest-stakes cold cases? We released a new version (v1.2.3.96) yesterday with significant updates. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR

[Arsenal Recon @ArsenalRecon]

Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR

[Arsenal Recon @ArsenalRecon]

Here's the new Hibernation Recon running on Windows on Arm (WoA) & processing WoA, Windows x64, & Windows x86 hibernation (hiberfil.sys) files! We continue to put extremely powerful & unique functionality in the hands of #DFIR practitioners. Arm yourself! https://t.co/w8v2JqX7rn

[Arsenal Recon @ArsenalRecon]

Here's the new Hibernation Recon (v1.2.3.96) in action! What do you notice about Windows architecture support? Did you know that Hibernation Recon also supports hibernation from Windows XP through the latest build of 11? https://t.co/w8v2JqX7rn #DFIR