My Courses

By

Come learn from me! I teach a variety of courses at Spyder Forensics both in person and Live Remote.

Advanced Applied Database Forensics (5-Days)

During this course, participants will gain knowledge of how databases function in the storage of records and fields of information to support a front-end application.  SQLite will be covered in detail where the attendee will learn how to recover deleted information from Free Pages, Freeblocks and unallocated space within the primary and journal files. Additional databases will then be examined including ESE, LevelDB’s and Binary Plists.

Upcoming Course Dates

Host-Based Dark Web Forensics (5-Days)

During this course, participants will gain a detailed understanding of the software used to access the Dark networks and what data persists from their usage. Utilizing various techniques and forensic applications, participants will learn how to recognize the presence of the Dark Web tools on multiple platforms, and how to extract the relevant information. Topics covered include deciphering Tor Browser artifacts on Windows®, Android and iOS, identifying and extracting Tor Browser activity from Memory, a forensic look at I2P and Hyphanet Artifacts found on a Windows® device, and decoding popular cryptocurrency wallets. 

Upcoming Course Dates





Popular posts from this blog

The Duck Hunters Guide - DuckDuckGo Android Cheat Sheet

By
Image
This cheat sheet contains the locations of forensic artifacts associated with the DuckDuckGo Android Browser.  It will be periodically updated as research is conducted History.db Location:  data\data\com.duckduckgo.mobile.android\databases\ Artifacts:  Browsing History App.db Location:  data\data\com.duckduckgo.mobile.android\databases\ Artifacts:  Open Tabs Bookmarks/Favorites Fireproof Sites Cookies Location:  data\data\com.duckduckgo.mobile.android\app_webview\default Artifacts:  Cookies com.duckduckgo.app.settings_activity.settings.xml Location:  data\data\com.duckduckgo.mobile.android\shared_prefs\ Artifacts:  Automatic Clearing Settings com.duckduckgo.app.fire.unsentpixels.settings.xml Location:   data\data\com.duckduckgo.mobile.android\shared_prefs\ Artifacts:  Datetime when data was last cleared tabPreviews Cache Folder Location:  data\data\com.duckduckgo.mobile.android\cache\ Artifacts:  Open Tab Preview Files Clo...
Read more

SQBite Beta Release

By
Image
On Friday 28th March I uploaded the Beta Code for SQBite to Spyder Forensics Github. This version was a major update from the Alpha code that I released earlier this year, with new features and a completely different output format which is a lot easier to work. Note: In the initial release there were a few bugs that were identified which I fixed in beta 2, a few more in Beta 3 and another in Beta 4. Just a reminder: The purpose of this tool is not to reinvent the wheel for forensics on SQLite databases, but to be used for validation, and as an educational tool for  my Advanced Applied Database Forensics class that I teach at Spyder Forensics (My employer). There is a lot more information about the records that is output than you would typically see in your main forensic tools. For example, the first 7 columns for a record in the output is not the record content but information about the record and where it is physically located. The latest version of the tool can be downloaded fro...
Read more

The Duck Hunters Guide - Blog #5 - Bookmarks & Favorites (Android)

By
Image
In this installment of the Duck Hunters Guide I am going to talk about the artifacts associated with Bookmarks and Favorites in the Android version of the DuckDuckGo web browser. Favorite sites are bookmarks that user has favorited. The favicon for a favorited site will show on a tile on a new browser tab to enable quick navigation to the URL. The main artifact for Bookmarks and Favorites is the app.db sqlite database. app.db location:  data\data\com.duckduckgo.mobile.android\databases\ This database has a lot of tables, including tables called bookmarks, bookmark folders and favorites. One would think that these tables would contain all the information about Bookmarks and Favorites; however, they are empty.  In actual fact the Bookmark and Favorite information goes into the entities table and the relations table. Entities Table The entities table contains the core information for Bookmarks and Folders. entityId - Type 4 UUID (Random) unique identifier title - Title for the Bo...
Read more