And that is all for this year's #DFIRSummit. We would like to thank our attendees, advisory board and speakers for making the 16th DFIR Summit a success!
We will see you next year 8/22-23 in #SALTLAKECITY!
#DFIR
@codeslack@williballenthin@mastodon I canβt seem to do anything on this app. It took me a while just to find some people, the I tried posting, added a photo, wouldnβt let me post, removed the photo, then could post, only to have my post failβ¦ Iβll give it a try but so far ending up frustrated.
These implement a really cool technique for parsing data structures from c headers. This is the type of stuff I love to see and study! great stuff @foxit#DFIR
Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a
@codeslack@hal_pomeranz I have used it a lot, and created the original project it was based on. But I would say it would want a new version if I was implementing something for ntfs. I also love the concept that @scudette went with where you only parse the bare minimum needed at a time for enum.
@codeslack@hal_pomeranz Thatβs the beautiful part about the trait system. You could make a handler that uses TSK to implement said traits and not be any further behind, but add in more as you make them.