Nicole Ibrahim

[Nicole Ibrahim @nicoleibrahim]

@SwiftForensics My pleasure!!

[Nicole Ibrahim @nicoleibrahim]

Loving the SANS DFIR summit 2019 presentations on YouTube!!

[Nicole Ibrahim @nicoleibrahim]

@Ch33r10 @DFIRSummit Here is the latest build. Commandline executables for Windows and MacOS. https://t.co/5HR1GuusQd

[Nicole Ibrahim @nicoleibrahim]

@JPoForenso @PhilHagen Actually, it depends on what you do while in Gallery view. Changing some of the view options will update the parent folder's DS_Store with an entry for the folder being viewed in Gallery view.

[SANS DFIR @sansforensics]

Check out the amazing #DFIRSummit agenda @robtlee @PhilHagen and the advisory board has put together! We'll have talks from @armangungor @jtsylve @moustik01 @nicoleibrahim and more!

July 25-26 | Agenda: https://t.co/ENtjszh9uN #DFIR #InfoSec

[Nicole Ibrahim @nicoleibrahim]

@AaronSWeiss I Don't have any files for testing from this folder. Hex Screenshots of the file headers of the OneDrive EtwTraces? Haven't experienced zlib compressed ETL files. Do you have a sample ETL file your can share?

[Nicole Ibrahim @nicoleibrahim]

@teresapereira_ Thanks Ana. Glad you enjoyed it. Hope it befits you.

[Nicole Ibrahim @nicoleibrahim]

@ToomsDK @DFIRSummit ETL viewer is not available for download unfortunately.

[Nicole Ibrahim @nicoleibrahim]

@GamerForensic Thats MUS from @MagnetForensics. Magnet User Summit 2019. https://t.co/czO3209UW7

[Nicole Ibrahim @nicoleibrahim]

@GamerForensic It outputs to a csv file and an sqlite database allowing you to filter by column or running sqlite queries respectively. I will discuss cmdline output searching and filtering tips at #MUS during my talk.

[Nicole Ibrahim @nicoleibrahim]

@GamerForensic And write up a blog post for those who are unable to attend.

[Nicole Ibrahim @nicoleibrahim]

@DFIRSummit @darthsaac I hear ya. I found USB device enumeration in a WDIContextLogs ETL the other day. When will the data end? #somuchdata #solittletime

[Nicole Ibrahim @nicoleibrahim]

@HeatherMahalik Love. Reminds me of my Lilly dog. A Shepard mix with similar markings.

[David Cowen @HECFBlog]

Going live with the #forensiclunch test kitchen! https://t.co/2QDAJZaW9s

Tonight testing the new USB external device forensics locations and USB Detective

[Nicole Ibrahim @nicoleibrahim]

@Hexacorn @HECFBlog The structure of the event record is documented by microsoft. Parsing the payload (user data) is where the difficulty comes into play

[Nicole Ibrahim @nicoleibrahim]

@Hexacorn @HECFBlog The code is based off of PyETW that has been heavily re-worked to parse the payload without engaging Windows APIs. There is a section in the code where it engages Windows APIs, but not for the purpose of decoding the event payload

[Nicole Ibrahim @nicoleibrahim]

@forensic_matt killed it talking about Automating Analysis with ArangoDB #dfirsummit