Ian Eubanks

[Ian Eubanks @IanEubanks2]

Just achieved my certification in CompTIA A+ this past weekend.

[Ian Eubanks @IanEubanks2]

View my verified achievement from @comptia. https://t.co/A0SGdiHYtG

[Elliot @ElliotKillick]

I found out "C:\Windows\System32\WorkFolders.exe" (signed by MS) can be used to run arbitrary executables in the current working directory with the name control.exe. It's like a new rundll32.exe #lolbin but for EXEs!

[Ian Eubanks @IanEubanks2]

@MagnetForensics I followed the video started examining our disk image. However, Axiom never shows the artifacts even though we're trying to create them. It may have to do with the tests that we were doing. Using bothDPAPI and E2EE with zoom to see if there is a difference #DFIR @MagnetForensics

[Ian Eubanks @IanEubanks2]

Anyone knows how to decrypt Zoom files, working on a project with my teammate, and every time we try and use Magnet Axiom, it does not recognize the Zoom artifacts. Any tools or suggestions? #DFIR @MagnetForensics