Matthew Seyer 🇺🇦

DIGITAL FORENSICS - where every bit counts.

[Matthew Seyer 🇺🇦 @forensic_matt]

@KevinPagano3 Correlate between EXTX and SRUM? Or just parses SRUM? If correlate, what does it correlate? I have only seen the parsing part.

[Matthew Seyer 🇺🇦 @forensic_matt]

The sans summit is always one of the highlights of my year.

[SANS DFIR @sansforensics]

And that is all for this year's #DFIRSummit. We would like to thank our attendees, advisory board and speakers for making the 16th DFIR Summit a success!

We will see you next year 8/22-23 in #SALTLAKECITY!

#DFIR

[Matthew Seyer 🇺🇦 @forensic_matt]

@codeslack @c0ntrol_z @sansforensics @sleuthkit Hanging out with @carrier4n6 has been a highlight of this trip for sure.

[Matthew Seyer 🇺🇦 @forensic_matt]

@codeslack @c0ntrol_z @sansforensics Thanks! @yamatosecurity does do amazing stuff.

[Matthew Seyer 🇺🇦 @forensic_matt]

I’m peacing out on Twitter for a while. ✌️

[Matthew Seyer 🇺🇦 @forensic_matt]

@DAVNADS Don’t hate me for keeping you hip

[Matthew Seyer 🇺🇦 @forensic_matt]

Posting more and more over here. Trying to use it more for my microblogging.

[Matthew Seyer 🇺🇦 @forensic_matt]

Just an FYI, you can find me over at Mastodon

https://t.co/Wtcz3ToHUh

[Matthew Seyer 🇺🇦 @forensic_matt]

Just an FYI, you can find me over at Mastodon

https://t.co/Wtcz3ToHUh

[Matthew Seyer 🇺🇦 @forensic_matt]

@williballenthin @msuiche I’ve been playing around with https://t.co/vobnxTxKBC a bit

[Matthew Seyer 🇺🇦 @forensic_matt]

@codeslack @williballenthin @mastodon I can’t seem to do anything on this app. It took me a while just to find some people, the I tried posting, added a photo, wouldn’t let me post, removed the photo, then could post, only to have my post fail… I’ll give it a try but so far ending up frustrated.

[Matthew Seyer 🇺🇦 @forensic_matt]

@williballenthin @mastodon Alright, I’ll do this with you

[Matthew Seyer 🇺🇦 @forensic_matt]

@DebugPrivilege @binaryz0ne I second this one, you are very valuable.

[Matthew Seyer 🇺🇦 @forensic_matt]

@PhilHagen @goldfingermusic Awesome! Superman is my go to mountain biking song. Thanks Tony Hawk…

[Matthew Seyer 🇺🇦 @forensic_matt]

@errno_fail Thanks for sharing! I always like how much effort you put into your issues. This is interesting.

[Matthew Seyer 🇺🇦 @forensic_matt]

@rickhholland I lived in Argentina for a bit. This is a dream of mine! Congrats!

[Willi Ballenthin @williballenthin]

Rust in the Linux kernel, Rust in Windows DirectWrite, …

[Matthew Seyer 🇺🇦 @forensic_matt]

@DAVNADS Mmmmm wing dust

[Matthew Seyer 🇺🇦 @forensic_matt]

These implement a really cool technique for parsing data structures from c headers. This is the type of stuff I love to see and study! great stuff @foxit #DFIR

[Dirk-jan @_dirkjan]

Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a

[Matthew Seyer 🇺🇦 @forensic_matt]

@codeslack @hal_pomeranz I have used it a lot, and created the original project it was based on. But I would say it would want a new version if I was implementing something for ntfs. I also love the concept that @scudette went with where you only parse the bare minimum needed at a time for enum.

[Matthew Seyer 🇺🇦 @forensic_matt]

@codeslack @hal_pomeranz That’s the beautiful part about the trait system. You could make a handler that uses TSK to implement said traits and not be any further behind, but add in more as you make them.