I’ve been doing the Forensic 4:cast Awards for 15 years. Just to give you some context of how long I’ve been doing this… In 2009, when the awards started: Bitcoin was invented The “Miracle on the Hudson” happened Barack Obama became President Minecraft had its first official update Swine Flu became a global pandemic (if only we knew…) Michael Jackson died Windows 7 was released Harry Potter and the Half-Blood Price & Twilight: New Moon were the movies to watch The awards started as Simon and I wearing suit jackets, standing in front or a white wall in our office at Zentek. The popularity ..read more

Yes, I finally found the time to tally the nominations and get the voting up. And there’s some interesting developments. It looks like the 4:cast Awards has garnered international recognition, most in Brasil. Looking at the categories, there’s a lot of good nominees to choose from, so take your time, as you only get one set of votes. Visit the link below to post your votes. https://forms.office.com/r/RB1QeKmDsM https://forms.office.com/r/RB1QeKmDsM ..read more

Admit it, you thought I’d forgotten, didn’t you? No, life and my new job are pretty busy, so finding time can be difficult. Maybe I’ll get ChatGPT to write the blurb to save me some time. OK, here goes… It’s your boy Snoop D-O-Double-G, and I’m here to tell you about the Forensic 4:cast Awards! Listen up, ’cause nominations are officially open, and we need your help to recognize the best in the digital forensics and incident response game. We got categories for everything from the Best Digital Forensic Blog to the Best Computer Forensic Hardware. So if you know someone or something that deserv ..read more

I’ve never worked anywhere for as long as I’ve worked at SANS. I started in February of 2017 and have had several roles in the company since. I started supporting OnDemand students and made my way up until I was testing lab exercises for many of the classes taught at SANS. I love the company and believe in its mission. During my time there I’ve seen exceptional people join the company with the goal to make it better and improve the product, and they have. SANS is, without any doubt, the best job I’ve ever had and a great organization. When I joined SANS, someone told me, “Don’t think of this a ..read more

Yes, finally the voting is open. It has been a long road to getting here this year, just so much going on. As the DFIR Summit isn’t happening until August this year, where’s the harm in delaying the voting until such time that I could give it the attention it deserves? Also, I won’t be physically at the Summit this year. I’m teaching in Amsterdam, so I’ll be there virtually to host the awards. Enough talking, you want to vote, here you go… Voting closes on July 24, 2022. https://forms.gle/nRDGNP2qeEVPPyPj6 ..read more

So I keep getting the question, ”when will voting for the awards open?” Well… soon. My host has been troubleshooting my site for about a month now and we’ve finally identified and resolved the issue. Now that everything is up and running again (and much time has been wasted) I’m going to keep the nominations open for one more week. Nominations will now close on June 26. Voting will be open on Monday, June 27. Nominations can be posted here: https://forms.gle/g6hDp9uaErvoNzt68 ..read more

If you’ve clicked on the link looking for a technical article, you’re going to be disappointed. This post is more about something that I’ve been thinking about for a while. Last month Texas suffered another ice storm. Before moving to this state, I’d never heard of “freezing rain” and just assumed it was Texan for hail. Boy, was I wrong on both counts? Hail here is the size of golf balls (and occasionally softballs) and freezing rain is… well, it’s just weird. It’s rain that freezes on contact with a surface. It looks beautiful but causes problems in a state that isn’t used to cold weather. On ..read more

In a break from the norm, I’m going to start with a Bible reference. Romans 2:21 says: “Thou therefore which teachest another, teachest thou not thyself?” As a SANS Instructor this couldn’t be truer. Every time I teach a class, I am asked at least one question where I think, “huh, I’d never considered that before,” or “I really need to go look at that.” Last week I had the pleasure of teaching a group of students (mostly from Japan) about Windows forensics (see SANS FOR500) when we reached the section about historical wireless networks. At that point a student asked if we could tell if MA ..read more

I started this back in April and hoped to have it finished for the 4:cast Awards last month. Sadly, life got in the way. This evening I had the time to finish it off. Hope you enjoy it. https://youtu.be/mQCyKahY_oY Lyrics below: Harlan Carvey, EnCase, Cellebrite, X-Ways Champlain, Huber, Exiftool, Ultradock 5 Sysinternals, Paraben, tools from Eric Zimmerman, iLook, Ackerman, Registry Hives Elcomsoft, Helix3, Andrew Case, and WinFE Teel Tech, Mandiant, and then Volatility Sarah Edwards, Blacklight, imaging with Insight Santiago, TZWorks, Jonathan Zdzjarski We didn’t start the fire It was always ..read more

Wait, what? Didn’t the awards just finish like 3 days ago? Yes, yes they did. So why are we already seeing nominations for next year? I’m glad you asked… For the last 13 years, the Forensic 4:cast Awards has run in June/July BUT the awards are meant to be for work carried out from January through December of the previous year. As such, we end up with nominations for work conducted outside the scope. This can lead to confusion and a little distress on my part. Also, people just plain forget. Asking anyone to post a nomination up to a year and a half after the work was completed, means that they ..read more