Advertisement
Greetings! It's been a while, I know. I am doing some forensics and I am carving files out of unallocated space. As you can imagine, that's a lot of files to be going through! Here is a screenshot of all the exe files found in unallocated space. Ugh thats a lot. I will show you in a later post how to use cuckoo to make life a bit easier in that department, but lets say you want to focus on 'known' files. Well, where is a good place for known files? The NSRL database! Well its gotten quite large now ... so what if you don't want to download that behemoth (or you live in Central London and your internet speeds stink)?Link: Sketchymoose's Blog

Advertisement
Advertisement