Last week we released Cado Live, a free tool to acquire disk images to cloud storage. — This week, we’ve released another free tool. Cado Host collects forensic artefacts from Windows/Linux/OSX systems (MFT, Logs, etc.) and uploads them directly to cloud storage (AWS/Azure/Google Cloud). It’s now available to download at no-cost: Download Now

I started the Medium account Forensic Labs some time ago, mostly posting on cloud forensics. At the time I added a little link saying “Sign Up if you’d like to beta-test a cloud forensic tool”. When I posted the articles I was gauging interest. And after a few hundred people…

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. A large number of server-side exploits have been used over the last year to install crypto-currency mining malware. Below we’ve outlined the typical stages of…

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. A core part of intelligence driven incident response is searching relevant indicators across a compromised network. …

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. Incident response with Azure, like other cloud providers, is a little different. Below we’ve outlined where to look if you’re performing Detection, Triage, Investigation or…

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. Initial Triage Generally it’s a good idea to switch off or hibernate the infected system, in case you are lucky enough it hasn’t finished encrypting…

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. MITRE have done a great job with the “ATT&CK framework” - a methodical breakdown of the various methods an attacker might use. …

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. SANS SIFT was created by Rob Lee and other instructors at SANS to provide a free tool to use in forensic courses such as SANS…

We’ve created a new tool to automate investigating and responding to security incidents in AWS and Azure — you can get a free trial here. In Amazon Web Services, forensics is a little different. Below I’ve outlined some of the core techniques: Acquiring an EC2 Instance Drives / Volumes To acquire the drive of…