James Smith 🇺🇦

InfoSec Professional. Hacker Hogwarts Student (SANS MSISE Student) on the warpath to GSE. DFIR Nerd. Back alley PenTester. D&D / Tabletop Gamer.

[James Smith 🇺🇦 @DFIRmadness]

Attention Digital Forensics (#DFIR) pro’s and beginners! I made a thing:

A whole IR case to work through. It includes:
• Disk Images
• Memory Images
• A Pcap
• And more

All from the same incident!

-And free training on how to solve it!

https://t.co/DE8ktUJA6j

Thread...

[vx-underground @vxunderground]

Meanwhile in San Francisco:

[James Smith 🇺🇦 @DFIRmadness]

Can’t have an incident if you can’t detect it…

[Dave Kennedy @HackingDave]

😬😬😬😬

“Microsoft has notified customers that it’s missing more than two weeks of security logs for some of its cloud products, leaving network defenders without critical data for detecting possible intrusions.”

https://t.co/gU7fQi1jRI

[Dave Kennedy @HackingDave]

😬😬😬😬

“Microsoft has notified customers that it’s missing more than two weeks of security logs for some of its cloud products, leaving network defenders without critical data for detecting possible intrusions.”

https://t.co/gU7fQi1jRI

[James Smith 🇺🇦 @DFIRmadness]

Yup. I’ve been saying this for years. The only thing they may keep around is Android. Maybe.

[Richard Hyland @richardhyland]

@killedbygoogle Why would anyone trust any google service for anything important. Google just shuts everything down eventually

[Richard Hyland @richardhyland]

@killedbygoogle Why would anyone trust any google service for anything important. Google just shuts everything down eventually

[James Smith 🇺🇦 @DFIRmadness]

@Ell_o_Punk Spoken like a true synthetic life form! I knew it!

[James Smith 🇺🇦 @DFIRmadness]

@JoeKnowsCyber @DecryptedTech @bettersafetynet Came here to post this. It’s a great way to remember what you need.

[James Smith 🇺🇦 @DFIRmadness]

@klrgrz Ha. I can’t recall which book did that to me last - but it’s a bummer because it really takes away from the story/book etc.

[Denis Laskov 🇮🇱 @it4sec]

Gone in 61 seconds.

The keys were left near the front door.

[James Smith 🇺🇦 @DFIRmadness]

@bettersafetynet And yes- there always exceptions based on the student etc.

And yes there are total bad asses without a single day of college under their belt.

[James Smith 🇺🇦 @DFIRmadness]

@bettersafetynet Completely agree with your main point.

It may be a local thing- but there was a huge difference in skill levels amongst security folks who took compsci vs CyberSec (Compsci w/ better foundation and competence). The field is seemingly starting to level- likely bc your point

[Prof. Feynman @ProfFeynman]

Teach your children that not knowing something is not a bad thing, it is an opportunity to learn something.

Teach them that making mistake is not failure, it's the first step to understanding.

[James Smith 🇺🇦 @DFIRmadness]

@dwmetz @trfflhntr Nice! Yeah 4 doesn’t seem too shabby on Linux generally. Some tools are memory hogs and I like to have the extra room….

I am betting that an ESXI server is more effecient?

Even 4 on a laptop VM is going to work well enough to get by from my experience.

[James Smith 🇺🇦 @DFIRmadness]

@trfflhntr @dwmetz Usually 8 gigs for the DFIR VMs. If you think you’re hitting a ram ceiling just take a look at Resource Monitor or HTOP and go from there is my advice.

[Florian Roth ⚡️ @cyb3rops]

Okay, who did this?
https://t.co/Nai56qwm97

[James Smith 🇺🇦 @DFIRmadness]

@SYSTEMCAWL @cyb3rops Is there a difference? Haha

[Prof. Feynman @ProfFeynman]

Did you know that it's actually possible for you to say, “I don't know enough about this to have an opinion.”

[Prof. Feynman @ProfFeynman]

Do not use your energy to worry. Life is too short to worry about stupid things. Have fun. Fall in love. Regret nothing, and don't let people bring you down. Study, think, create, and grow. Teach yourself and teach others.

[James Smith 🇺🇦 @DFIRmadness]

@Ell_o_Punk Before anyone grabs a pitchfork- I said I try and say “folks”. 🙂🙃 I have years of teaching experience, with a large spectrum of students… rainbow… military… mid westerners… big city folks… no issues with offending folks.🙂 Folks that say “guys” aren’t “out to get ‘em”.

[James Smith 🇺🇦 @DFIRmadness]

@Ell_o_Punk I try and say “folks” as best as I can… but unwiring 40 years of gender-neutral-intended “dude” and “guys” is tough.

Reasonable people understand, don’t care, or give grace. Those who make a big todo when someone clearly isn’t being a dick, or misgendering etc. are lame.