My Courses

By

Come learn from me! I teach a variety of courses at Spyder Forensics both in person and Live Remote.

Advanced Applied Database Forensics (5-Days)

During this course, participants will gain knowledge of how databases function in the storage of records and fields of information to support a front-end application.  SQLite will be covered in detail where the attendee will learn how to recover deleted information from Free Pages, Freeblocks and unallocated space within the primary and journal files. Additional databases will then be examined including ESE, LevelDB’s, RealmDB.

Upcoming Course Dates

Host-Based Dark Web Forensics (5-Days)

During this course, participants will gain a detailed understanding of the software used to access the Dark networks and what data persists from their usage. Utilizing various techniques and forensic applications, participants will learn how to recognize the presence of the Dark Web tools on multiple platforms, and how to extract the relevant information. Topics covered include deciphering Tor Browser artifacts on Windows®, Android and iOS, identifying and extracting Tor Browser activity from Memory, a forensic look at I2P and Hyphanet Artifacts found on a Windows® device, and decoding popular cryptocurrency wallets. 

Upcoming Course Dates

SQLite Forensic Fundamentals (2-Days)

This two-day workshop is meticulously crafted to equip participants with a comprehensive understanding of SQLite exploitation. Through hands-on exploration, attendees will delve into the intricacies of extracting and deciphering information housed within SQLite databases, especially when conventional forensic tools may fall short.T.

Upcoming Course Dates 





Popular posts from this blog

The Duck Hunters Guide - Blog #6 - DuckDuckGo Fireproof Sites (Android)

By
Image
In this post I want to talk about fireproof sites in the Android version of the DuckDuckGo web browser and what information is immune to the fire button when a site is fireproofed. The concept of Fireproofing a site is a little misleading and when I searched online there is not much chatter about what this feature in the browser actually does. One would think that fireproofing a site would make browsing relating artifacts immune to the fire button, but this is not true. As part of my research process, I fireproofed a site  and then examined what data remained after clearing browsing data using the Fire Button. What I found is that the Fireproof feature preserves cookies for the selected site so users  don’t need to log in again after clearing data (session cookies remain intact). However, browsing history, cache, and other site data are still cleared , even for fireproofed sites. We will start with determining what sites the user has fireproofed. This information can be foun...
Read more

Introducing SQBite (Alpha) - Python Tool for Extracting Records from SQLite Databases

By
Image
A few days ago, I released the Alpha code for a new python tool I have been working on that extracts records from an SQLite database. Whilst I understand how SQLite Databases and their corresponding journal files work and have a solid understanding of the physical structured of the files, I am fairly new to Python (less than a year) and some of the functions I wrote provided me some challenges but I eventually figured out.  Over my digital forensics career, I have used many tools (both paid and open-source) to look at SQLite Databases at a forensic level and whilst many do an "OKAY" job with parsing records I have found that many miss a lot of data (or just not providing it the examiner) that could be critical evidence during an examination. The purpose of this tool is not to reinvent the wheel for forensics on SQLite databases, but to be used for validation, and as an educational tool for  my Advanced Applied Database Forensics class that I teach at Spyder Forensics (My empl...
Read more

The Duck Hunters Guide - Blog #1 - DuckDuckGo Privacy Browser Research Project

By
Image
One of my passions in Digital Forensics is ripping apart applications and trying to figure out how they work and how they store data. Over the past 5 years as part of my job, I have had what some may call an "unhealthy" obsession with Dark Web applications. I have looked into Tor, I2P, Hyphanet (Formerly Freenet) and ZeroNet on multiple platforms, examining the features as new updates come out, in an attempt to uncover usage artifacts.  So, for a new research project (in my personal time) and for my first blog series I will be following a similar methodology to track down user artifacts associated with the DuckDuckGo privacy browser. This project has been on my research list for some time, and what sparked my interest was a blog I read in early 2024 that compares the application decoding capabilities of forensics tools.  Link:   iOS 15 Image Forensics Analysis and Tools Comparison - Browsers, Mail Clients, and Productivity apps I wasn't entirely shocked about the differe...
Read more