sleuthkit

Official account for The Sleuth Kit and Autopsy open source digital forensics tools.

[sleuthkit @sleuthkit]

Autopsy release webinar happening today at 11 Eastern. See the new keyword search and malware scanning module in action! And ask Brian any questions.

https://t.co/ES32ePfTtP

[sleuthkit @sleuthkit]

The Sleuth Kit 4.12.1 is out. Mostly bug fixes on the C++ side (from Luis Nassif and Joachim Metz) and some Java changes motivated by Autopsy & Cyber Triage.

https://t.co/OFwF4NYuoV

[Brian Carrier @carrier4n6]

Autopsy 4.21.0 is out with index-less keyword searching, a Cyber Triage malware scanning module, and lots of #DFIR updates.

👀👀AUTOPSY IS ALIVE. 👀👀

Blog post: https://t.co/lV0A9k2btp

Webinar On Sept 12: https://t.co/QhWWFvxbQx

[sleuthkit @sleuthkit]

The Sleuth Kit 4.12.0 is also out. Major new feature there is LVM support on Linux from @joachimmetz and limited logical folder support.

https://t.co/ldsLsHPRG5

[sleuthkit @sleuthkit]

Autopsy 4.20.0 is out after a 1-year delay!!! Learn about the new features (including a new pipeline and more Jython modules), why it's been quiet for a year, and what's in store for 2023.

https://t.co/fRKTWDNHRn

[Brian Carrier @carrier4n6]

ResponderCon: Investigating Ransomware agenda is up and registration is open! Great submissions and we decided to add a 2nd track. 16 talks. 1 day. Very exciting! Sept 13.

Learn case studies, tools, artifacts, process, and more.

https://t.co/p2sc1WESxj

[Brian Carrier @carrier4n6]

We have a new Director of Training position open for Cyber Triage and Autopsy. Come join us to build and teach incident response and forensics (#DFIR) courses in-person and online. You'll also get to impact new features.

https://t.co/HgyMlNyx0O

[Brian Carrier @carrier4n6]

2 Days Left to submit a talk to the biggest (and only) DFIR-specific Ransomware Investigation event! Lots of great submissions already.

One gap is a talk from a victim their lessons. Topics on attack vectors, deployment mechanisms, etc. encouraged.

https://t.co/pSRSdB9yJl

[sleuthkit @sleuthkit]

Autopsy 4.19.3 is out with Log4J fix (and Solr 8.11.0 upgrade).

This was a manual build and only the 64-bit version was made. The next major release will have more options and will have Solr 8.11.1.

https://t.co/42VMR8m6LF

[sleuthkit @sleuthkit]

@SveinHopland Hopefully today. We decided to integrate an official new Solr release instead of doing manual changes to various JAR files.

[sleuthkit @sleuthkit]

The embedded version of Solr in Autopsy uses Log4j2. Blog post is up with steps on disabling the vulnerable feature.

https://t.co/ZhBdTUasi0

[sleuthkit @sleuthkit]

@KevinPagano3 @Cellebrite @CyberRaiju Thanks.

Blog post is up about disabling the log4j feature in the embedded Solr.

https://t.co/ZhBdTUasi0

[Brian Carrier @carrier4n6]

Want some #OSDFCon glory without a full, technical talk? Submit a short video and we'll play it during the breaks.

Examples:
"You might be in DFIR if ____"
"I hate it when tools ___"
"I love it when tools ___"
Tips and tricks
Tik Tok Dances

Due Nov 28

https://t.co/v162z64a9f

[Brian Carrier @carrier4n6]

2 weeks until #OSDFCon (Dec 1). It's time for you to register and put it on your calendar and for me to start working on Autopsy slides. Con is virtual and free.

https://t.co/OB6FjSlrhs

Swag this year has Hash as a super hero!

[sleuthkit @sleuthkit]

Autopsy 4.19.2 is out. Continued UI enhancements to the Analysis Result vs Data Artifact concept and several bug fixes.

https://t.co/PVPMZjaTd6

Also out is a corresponding TSK release with fixes from @joachimmetz, Joel Uckelman, and Kim Stone.

[Brian Carrier @carrier4n6]

New post about Azure with Cyber Triage / Autopsy databases. TLDR: Similar to Google. Cheaper and Faster than AWS. ☁️ ☁️ ☁️

Post has a summary of all three providers if you are looking to put your #DFIR lab in the cloud.

https://t.co/QMQ5UBzmu4

[Brian Carrier @carrier4n6]

We finished our Google Cloud testing and found it was faster and cheaper than AWS for PostgreSQL. ☁️💰☁️💰

Results apply to both Autopsy and Cyber Triage. Blog has GCP basics, results, and CT setup.

https://t.co/udaDRis3Zo

@googlecloud

[sleuthkit @sleuthkit]

The options in this "forensics in the cloud" post are also relevant to Autopsy (since it uses the same DB as Cyber Triage).

[Brian Carrier @carrier4n6]

Our first cloud database post is up about @awscloud. We get a lot of requests about how to run Cyber Triage and Autopsy in the cloud, so we did some experiments with CT.

Learn about your #DFIR database options and our test results.

https://t.co/6YzDXULhsy

[Brian Carrier @carrier4n6]

After a crazy long delay, the #OSDFCon agenda is out!

There's talks on live DFIR, event logs, Autopsy updates, memory, EDR, and much more! We moved to Dec 1 and it's entirely virtual.

Agenda: https://t.co/tAwfossz44

Register for free:
https://t.co/S2GMiV80rw

[sleuthkit @sleuthkit]

One week left for the 2021 Autopsy Module competition!

💰 Cash Prizes. 💰

Python or Java. Make modules to flag various files or extract out artifacts!

https://t.co/9lY1Z2UpnN