Archives For August 2012

New anti-forensics tool SetRegTime can change Registry last write times. | http://t.co/atWsf4sE via @
@chadtilbury
Chad Tilbury

 

Harlan Carvey discusses the ramifications of Windows Registry anti-forensics on his blog:  http://windowsir.blogspot.com/2012/08/setregtime.html.

You can find SetRegTime here: http://code.google.com/p/mft2csv/wiki/SetRegTime

Collusion for Chrome Graph

While doing some browser forensics research, I stumbled upon a Chrome extension named Collusion for Chrome.     This extension provides a visual representation of the tracking information shared with third party sites during web browsing .  While the notion of browser tracking is hardly surprising these days, Collusion provides some of the most compelling evidence I have seen for the “Do Not Track” movement.

As an example, the image above shows my browser activity during a brief period.   I selected a specific node corresponding to Wired.com and you can see the vast number of external connections a visit to Wired spawns.  Information about the various contacted sites can be identified using the following key:

  • Blue nodes:  Sites previously visited by the user
  • Gray nodes:  Third party sites receiving browser data (never visited by user)
  • Red nodes:  Known aggregators of tracking information (the slash indicates the site was blocked by Collusion)

Continue Reading…