Kevin Perryman

[Kevin Perryman @DFIRTech]

4/4 https://t.co/8IioWuFWBf & https://t.co/ria0sHMn1D
Companion service logmon handles rotation + retention so your evidence never ages out.

Both install as a Windows service.

Both free; a non-commercial license (PolyForm-NC).

🔗 https://t.co/pmPnVTTh8G
🔗 https://t.co/mddbaM00SP
Feedback welcome!

#DFIR #IR #WindowsForensics

[Kevin Perryman @DFIRTech]

1/4 https://t.co/8IioWuFWBf & https://t.co/ria0sHMn1D
Windows' USN Journal is a goldmine for forensic investigators — file creates, deletes, renames, security changes, all timestamped, all NTFS.

Problem: it's a 32 MB rolling buffer. On a busy machine, <1 day before records age out forever. 🧵

[Kevin Perryman @DFIRTech]

3/4 https://t.co/8IioWuFWBf & https://t.co/ria0sHMn1D
Bonus features I'm most proud of:

🕵️ Deleted files resolve to full paths (via parent MFT ref)
🔌 Every USB attach/detach captured — even exFAT/UDF drives Windows can't journal
⏯️ Gap-free resume across reboots (923 events tell you what you missed)

[SANS Cloud Security @SANSCloudSec]

The first three episodes of the #CloudAcePodcast are here!

Listen to @anton_chuvakin @fykim @kymidd @NightmareJS @kfosaaen as they discuss the latest in cloud security with host @brandonmaxevans.

Subscribe, rate and review wherever you get your podcasts: https://t.co/Vn4QLPfsmA

[Kevin Perryman @DFIRTech]

Cyber-security news for 05/25/2019 https://t.co/pdVHMG3jcY

[Kevin Perryman @DFIRTech]

@heathermahalik @domenicacrognal BEST Smartphone Forensics Instructors EVER! @sansforensics #FOR585

[Kevin Perryman @DFIRTech]

Thank you to our service men and women of the past, present and future. #IndependenceDay #Freedom

[Kevin Perryman @DFIRTech]

@TheScientist_SH RIP. The world was a better place because of you. May your life's works transcend the fabric of spacetime to inspire and grow in the minds and hearts of future generations.

[SANS Institute @SANSInstitute]

Classes at #SANSSeattle Spring 2018 are filling up! Register now to secure your seat AND save $400 on top-notch #cybersecurity training.

View details on courses, instructors, bonus sessions: https://t.co/Bjol5C5isH

[Kevin Perryman @DFIRTech]

My first "owned" computer Mega-8k RAM with the 16k Expansion Card and analog storage to cassette tape. Was TOTAL AWESOMENESS in a SPOON https://t.co/kiHPjHtzRP

[edskoudis @edskoudis]

In Secret Room, the team just asked me how I first got into computers. It was this commercial. IT. BLEW. MY. MIND!!
https://t.co/aimyCBht2X

[Kevin Perryman @DFIRTech]

Just got them in from https://t.co/WJL2rgkVoS. Now to really get down and dirty on reverse engineering malware. #FOR610 #GREM #SANSCDI

[Kevin Perryman @DFIRTech]

How is your company protecting itself?
https://t.co/Tmk30RWqK6

[Kevin Perryman @DFIRTech]

#SANSNetworkSecurity #Netwars #HackersHackingAllNightLong

[Kevin Perryman @DFIRTech]

BHIS-FTW! Some of the Best Professionals in all of InfoSecLand https://t.co/2VCg8s1CPZ

[Black Hills Information Security @BHinfoSecurity]

CONTEST: 1 DerbyCon ticket 1) sign up for our emails https://t.co/cL9R0cKaU6 2) retweet 3) follow 4) tweet your favorite #BHISblog / webcast

[Kevin Perryman @DFIRTech]

Starting a week of SEC573 Automating InfoSec with Python #SANSNetworkSecurity

[Kevin Perryman @DFIRTech]

Just another ordinary, average week. Welcome to an Information Based Society. https://t.co/u9rXHUVgvY

[Kevin Perryman @DFIRTech]

@SANSPenTest @jeffmcjunkin @jeffmcjunkin - $200/yr for VMUG Advantage Subscription for a ton of VMWare software. https://t.co/2HmQPtjHug #KickingAss #EVALExperienceFTW

[Kevin Perryman @DFIRTech]

Not too late to sign up for the best InfoSec training in the world. #SANSNetworkSecurity https://t.co/6JJmQaoLdo
I'll be there, will you?

[Kevin Perryman @DFIRTech]

Been on "technology free vacation" and on the road for the past week. Time to get back into the habit.

https://t.co/pf733jiYaY