Visualizations - dfir.blog

Visualizations

A collection of 11 posts

Keystroke Flow from Chrome Omnibox

Keystroke Flow from Chrome Omnibox

I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram.

Unfurl... in 3D

Unfurl... in 3D

Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!

Introducing Unfurl

Introducing Unfurl

Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL up into components, extracting as much information as it can from each piece, and presenting it

Capturing Chrome's Evolution

Capturing Chrome's Evolution

When I was pretty fresh in the field of digital forensics, I picked this new thing called Google Chrome to dig into. There weren't a lot of tools out there that could parse it and I thought learning about browser history would be a useful skill for me.

Chrome Evolution

Chrome has evolved in many aspects since its release: the browser's appearance, capabilities, and how it stores data have all changed greatly since 2008. This page lets you explore how the files and databases that make up the browsing history recorded in a Chrome profile have evolved through

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

Presentations & Interviews

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. My abstract was: 小物の候補を比べる場合は、形、素材、色、固定方法を同じ基準で確認すると判断しやすくなります。具体的な候補を確認する場合は、猫耳コスプレ小物通販から関連する商品や情報を比較できます。大きな小物は会場の規則を確認し、安全に持ち運べる方法も準備しておくと安心です。 Reviewing web browsing activity is relevant in a wide variety of DFIR cases. With many users

Visualizing Activity from Metadata

Visualizing Activity from Metadata

Encrypted iPhone backup? That means it's useless to an investigator (or attacker), right? Not so fast. We can still get an incredible amount of insight into the actions on the devices from the metadata alone. I am currently taking Sarah Edward's FOR518: Mac Forensic Analysis from

Finding the First Thread with a Visualization

Finding the First Thread with a Visualization

Finding the first thread to pull to get an investigation started can sometimes be difficult. Having a checklist and a structured approach to your investigation can help quite a bit. Experience also can help you come up with a list of artifacts to review and places to check, but what

Visualizing USN Journal Activity

Visualizing USN Journal Activity

Since learning about the USN journal, my investigative process has never been the same. It is a powerful artifact that can tell us much about what has transpired on a system. However, the wealth of data that the USN journal brings to an investigation can be a double-edged sword: the

Chrome Databases Reference Chart Updated to Chrome v35

Chrome Databases Reference Chart Updated to Chrome v35

Chrome updated to version 35 a few days ago, and I'm releasing an updated version of my "Evolution of Chrome Databases Reference Chart" to cover those new versions. The first version of the reference chart covered Chrome v1 - v30. In the following five versions, there

The Evolution of Chrome Databases Reference Chart

The Evolution of Chrome Databases Reference Chart

Google's Chrome browser was updated to version 31 today. Chrome's rapid release cycle is great for quickly rolling out security fixes and new features, but it can also be a bit of a pain for amateur tool developers like me. On more than one occasion while