Posts

The best DFIR metrics are derived, not collected

By
The best DFIR metrics are derived, not collected In professionalizing versus proceduralizing security operations I talked a bit about an experience early in my EMS career where a data-collection exercise intended to improve patient care actually ended up getting in the way instead. That story is very relevant to this topic and I recommend reading the earlier post. The very short summary is: Years ago, as a volunteer EMT, I was part of a pilot program in collecting healthcare metrics. Paramedics and EMTs were given iPads (new at the time!) and asked to document every aspect of our patient care during the call. The medics hated this; paying attention to collecting data during the call directly distracted from actually taking care of the patient, resulting in worse health outcomes . In technology, If you’ve worked in an operations role of any sort (Helpdesk, sysadmin, datacenter operator, System Reliability Engineering (SRE), etc.) you’ve probably had at least a few run-ins with metrics...
Post a Comment
Read more

Discontinuing l2tscaffolder

By
  Discontinuing l2tscaffolder For years bootstrapping development for open-source digital forensics tools required dealing with a fair amount of repetitive boilerplate. To make life easier for developers writing parsers and plugins for tools like Plaso, Timesketch, and Turbinia, we relied on l2tscaffolder . By guiding developers through a series of questions, it cleanly generated the necessary templates and structure to get new modules off the ground. However, the software development landscape has fundamentally shifted. With the advent of advanced AI coding agents, the need for a dedicated, rigid template scaffolding tool has rapidly diminished. Modern AI coding assistants are now deeply context-aware and can generate complete, highly customized Plaso parsers or Timesketch plugins on demand simply by being fed example logs or data structures. Because these AI agents assist far better and offer unparalleled flexibility compared to static templates, we have decided to officially ret...
Post a Comment
Read more

Tampering with timelines - injecting false leads

By
Tampering with timelines - injecting false leads By: David André, copied with permission Background " Pearls and pitfalls of timeline analysis " went into some of the challenges of timeline analysis, such as information underflow, information overflow and interpreting timeline entries. One aspect that was only touched upon is that the data in a timeline is not necessarily trustworthy. Most of us are aware that the content of a log line can be influenced by whoever generated it. A less often asked question is: Which parts of a timeline entry come from the data, and which parts come from the tool? This article looks at a case where the answer turned out to be different from what one might expect.  The __utmz cookie Google Analytics (ga.js) used several cookies to track visitors, one of them is __utmz , which stores how a visitor reached a website. Its value consists of a domain hash, a timestamp, a session and a source count, followed by a | separated list of key=value varia...
Post a Comment
Read more

Plaso 20261027 released

By
Image
Plaso 20261027 released The Plaso team is delighted to announce a new Plaso release, 20261027. This release has a mixture of new features and under the hood improvements. A special shout out to @elhoim and @kev365 for all their changes to help improve Plaso. A friendly reminder if you are using a coding agent (or other type of artificial intelligence), please tune its output verbosity to a necessary minimum, have it follow project guidelines and standard practices, and double check any speculations it might make in write ups. For people reporting code weaknesses and/or vulnerabilities, we appreciate you helping improve Plaso’s resilience, but please do not speculate about impact and make sure to back up your claims by facts. Refrain from claiming hypothetical worst-case impact, please keep it factual . Assess trade-offs, sometimes a resilience change has adverse effects from the perspective of forensics reproducibility . The “log with a cape”' will always be a key part of log2tim...
Post a Comment
Read more