The Forensic 4Cast Awards (live video-cast) were posted at the end of the last week; a huge thanks to everyone who submitted nominations and voted, and thank you to those who voted for me in the Best Digital Forensics Blog and Best Digital Forensics Book categories! Watching the video, it looks as if Lee and Simon had a great deal of fun creating it, and I hope that they follow it up next year! Maybe some folks can contribute prizes...nothing fancy, just something simple.

Over on the RegRipper forums, Ken Pryor had this to say about the recently released RipXP (quoted with permission):
I finally got time to try it out today and must say it's a brilliant piece of work. I have immediate use for RipXP for a case I'm working on. Harlan, I thank you for all you do for us. I would gladly pay for RegRipper and RipXP and I am very thankful you provide them. I haven't worked a case yet that RegRipper didn't play a part in and I expect RipXP will be much the same.

Thanks for the words, Ken!

James Macfarlane has released an update to the Parse::Win32Registry Perl module that is the basis for such tools as RegRipper and RipXP. The most notable change to this version of the module are the ability to extract and view security descriptor information.

James has also updated some of the scripts included with the module. Rather than trying to describe them in my own words, I'll use James':

regshell.pl is a new interactive console program for browsing registry files. It is a little simpler to use than regdump.pl as it provides tab completion if you have a functioning Term::Readline. It should work on Windows. (Note: ActiveState includes Term::ReadLine::Perl and Term::ReadLine::Zoid on Windows)

regview.pl has been improved to include searching and bookmarking.

regmultidiff.pl is a new console program for comparing multiple registry files. It improves on the old regdiff.pl by allowing the comparison of an unlimited number of registry files.

regcompare.pl is a new GTK+ program for comparing multiple registry files.

If you're using ActiveState's Perl on Windows, you can install this module via PPM:

C:\Perl>ppm install parse-win32registry

If you already have it installed (ie, v. 0.41 or earlier) you can upgrade the installation:

C:\Perl>ppm install parse-win32registry

I have to say, from my perspective, James has made a HUGE contribution to the forensic community! Many, many thanks, James!

Speaking of tool releases, Paraben has released their P2 eXplorer image mounting tool for free! You can download the demo, but you have to "purchase" the free product (and yes, submit a credit card number), but once you receive the registration key, you can activate the full features of the product. I've played with it a little bit, and I think that having access to tools like this that provide a single, needed functionality at a reasonable price point (free, in this case) can really do a lot for the community. While the interface isn't entirely intuitive (who uses A:\ and B:\ any more??), the only other things I really don't like are the rotating banner ads for other Paraben products on the right-hand pane on the interface, and the inability to completely disable the generation of MD5 hashes for images that are mounted/unmounted...I'd rather see something more obvious in the tool about read-only functionality. However, P2X does generate a log of activity, so that's nice to have and include in your case notes. All in all, a good, commercial grade replacement for ImDisk and VDKWin. P2X also allows you to mount other image format types besides raw, dd-style formats, such as EnCase, SMART, SafeBack, etc.

If you use Volatility (if you don't...why not!?!), then you really need to take a look at some of the new plugins posted by Michael Hale Ligh. Some look like they'd be extremely helpful in detecting malicious goings-on...very cool, and thanks to MHL!

Lee Whitfield of the Forensic4Cast podcast reached out to me this past week, and asked me to be a guest on his podcast on Wed, 10 June.

If you've never listened to Lee's podcast, give it a shot...Matt Shannon of F-Response.com was interviewed, as well as others. Lee's also got a section for technical articles, many of which look to be extremely useful.

Lee's also taking nominations now through 21 June for Forensic4Cast Awards; be sure to place your vote in any or all of the various nomination categories. Take a look at the page to see how everything works, and dates for submissions, voting and the posting of the final results. While this isn't something huge that's going to get you a free pass to RSA next year or something, I do think that it's a great opportunity to show your appreciation for the work done in the various categories. See what Matt's posted as his nominations!

Speaking of podcasts, did you know that CERT has podcasts? Another security podcast out there is ExoticLiability. Man, there's just too much to check out!

Didier's posted some links to PDF analysis tidbits...very cool! Didier's done a great deal of work in the area, and his work reminds me a lot of the ComputerBytesMan's work in the area of MSWord metadata extraction. Now, some folks are going to look at these links and ask, "...okay, but how can I use this?" Far too often, folks will post links to other blogs or blogposts without any real explanation of how the information is useful, valuable, or important. Well, when conducting analysis of a compromised system, one of the questions that comes up very often is, how was the system compromised? What was the infection vector? It's pretty trivial, really, to scan a mounted image with AV software or to locate files that an intruder may have copied onto the system...but sometimes (many times?) we need to find out how they got in. One means of doing so is to run file signature analysis tools across web browser and email attachment cache directories to locate things like PDF documents or Excel spreadsheets the may have been downloaded. Finding such documents, which have recently been identified as having vulnerabilities, may lead to identifying the initial source of compromise or infection.

Moyix recently posted some Windows 7 Registry hives for examination, based on a request from Tim Morgan. I'd taken a look at hives from a Windows 7 VM earlier this year, and found that while key locations may change between various revs and versions of the OS, the binary structure appears to remain the same. Thankfully, MS hasn't moved to an all-XML format for the Registry (right now, a lot of you out there are going, "Dude, shut up!!"). I've been running my RegRipper plugins against the hives and dude...they work great!

Speaking of Registry hives, reviews of Windows Forensic Analysis 2/e are already starting to appear! It appears that some folks really like the Registry analysis chapter...maybe this is something to take off on it's own...what do you think? Should Registry Analysis become it's own book? Personally, I think that there's more than enough information out there for this...let me know your thoughts. Or let Syngress know your thoughts.

Finally, more reviews of WFA 2/e are being posted, and I've gotta thank Larry for his review of Perl Scripting for Windows Security! I greatly appreciate the efforts of those who are posting reviews, regardless of the forum. Thanks, folks!