Visualizations - dfir.blog

Visualizations

A collection of 11 posts

Keystroke Flow from Chrome Omnibox

Keystroke Flow from Chrome Omnibox

I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram.

Unfurl... in 3D

Unfurl... in 3D

Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!

Introducing Unfurl

Introducing Unfurl

Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL up into components, extracting as much information as it can from each piece, and presenting it

Capturing Chrome's Evolution

Capturing Chrome's Evolution

When I was pretty fresh in the field of digital forensics, I picked this new thing called Google Chrome to dig into. There weren't a lot of tools out there that could parse it and I thought learning about browser history would be a useful skill for me.

Chrome Evolution

Show One Level Show Two Levels Show All Version: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

Presentations & Interviews

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. My abstract was: Reviewing web browsing activity is relevant in a wide variety of DFIR cases. With many users having multiple devices that may need to be analyzed, we need better

Visualizing Activity from Metadata

Visualizing Activity from Metadata

Encrypted iPhone backup? That means it's useless to an investigator (or attacker), right? Not so fast. We can still get an incredible amount of insight into the actions on the devices from the metadata alone. I am currently taking Sarah Edward's FOR518: Mac Forensic Analysis from

Finding the First Thread with a Visualization

Finding the First Thread with a Visualization

Finding the first thread to pull to get an investigation started can sometimes be difficult. Having a checklist and a structured approach to your investigation can help quite a bit. Experience also can help you come up with a list of artifacts to review and places to check, but what

Visualizing USN Journal Activity

Visualizing USN Journal Activity

Since learning about the USN journal, my investigative process has never been the same. It is a powerful artifact that can tell us much about what has transpired on a system. However, the wealth of data that the USN journal brings to an investigation can be a double-edged sword: the

Chrome Databases Reference Chart Updated to Chrome v35

Chrome Databases Reference Chart Updated to Chrome v35

Chrome updated to version 35 a few days ago, and I'm releasing an updated version of my "Evolution of Chrome Databases Reference Chart" to cover those new versions. The first version of the reference chart covered Chrome v1 - v30. In the following five versions, there

The Evolution of Chrome Databases Reference Chart

The Evolution of Chrome Databases Reference Chart

Google's Chrome browser was updated to version 31 today. Chrome's rapid release cycle is great for quickly rolling out security fixes and new features, but it can also be a bit of a pain for amateur tool developers like me. On more than one occasion while