[B! forensic] hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hasegawayosuke id:hasegawayosuke

forensicã«é–¢ã™ã‚‹hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (13)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Internet Explorer 10 ã§ã¯ä¸€æ™‚ãƒ•ã‚¡ã‚¤ãƒ«ç®¡ç†æ–¹æ³•ãŒå¤‰æ›´ã•ã‚Œã¦ã„ã‚‹
ã€ŒIE ã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ã®ã‚ªãƒ•ãƒ©ã‚¤ãƒ³èª¿æŸ»ã«ã¤ã„ã¦ (æ”¹è¨‚ç‰ˆ)ã€ http://www.slideshare.net/hebikuzure/iecachedata-20130427-20103419 æ˜¨æ—¥ã®ç¬¬4å›žã€Œãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼å‹‰å¼·ä¼šã€ã§ç™ºè¡¨ã—ãŸå†…å®¹ã§ã€ä¸Šã«æŽ²è¼‰ã—ãŸãƒªãƒ³ã‚¯ã§è³‡æ–™ã‚¹ãƒ©ã‚¤ãƒ‰ã‚‚å…¬é–‹ã—ã¦ã„ã¾ã™ãŒã€ã“ã¡ã‚‰ã§ã‚‚ç°¡å˜ã«ã¾ã¨ã‚ã‚’æ›¸ã„ã¦ãŠãã¾ã™ã€‚ Inetrnet Explorer 9 ä»¥å‰ Internet Explorer 5 ä»¥é™ã€Internet Explorer 9 ã¾ã§ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã¯ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸€æ™‚ãƒ•ã‚¡ã‚¤ãƒ« (ã‚ãƒ£ãƒƒã‚·ãƒ¥ã€ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’å†åˆ©ç”¨ã®ãŸã‚ä¸€æ™‚ä¿å˜ã—ãŸã‚‚ã®) ã®ç®¡ç†æ–¹æ³•ã¯åŒã˜ã§ã—ãŸã€‚ã“ã‚Œã¯ã‚ˆãçŸ¥ã‚‰ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«ã€ä»¥ä¸‹ã®ã‚ˆã†ãªä»•çµ„ã¿ã§ã™ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆ ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã§è¡¨ç¤ºã•ã‚Œã‚‹æ—¢å®šã®ä¸€æ™‚ãƒ•ã‚¡ã‚¤ãƒ«ã®å ´æ‰€ã¯ä»¥ä¸‹ã®ãƒ‘ã‚¹ (Windows Vista ä»¥é™ã®å ´
hasegawayosuke 2013/04/30
ie

ie10

forensic
ãƒªãƒ³ã‚¯
USBãƒ‡ãƒã‚¤ã‚¹æŽ¥ç¶šæƒ…å ±ã®èª¿æŸ»
å›žç”ï¼š USBãƒ‡ãƒã‚¤ã‚¹ã®æŽ¥ç¶šæƒ…å ±ã‚’èª¿æŸ»ã™ã‚‹ãƒã‚¤ãƒ³ãƒˆã—ã¦ã¯ã€ä¸‹è¨˜ã®é …ç›®ãŒä¸€èˆ¬çš„ã«è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ 1.ãƒ¬ã‚¸ã‚¹ãƒˆãƒªãƒ•ã‚¡ã‚¤ãƒ«ã«ä¿å˜ã•ã‚Œã¦ã„ã‚‹ãƒ‡ãƒã‚¤ã‚¹æŽ¥ç¶šæƒ…å ± 2.ãƒ‡ãƒã‚¤ã‚¹æŽ¥ç¶šæ™‚ã«ä½œæˆã•ã‚Œã‚‹ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ« 3.USBæ©Ÿå™¨ä¸Šã®ãƒ•ã‚¡ã‚¤ãƒ«åˆ©ç”¨ç—•è·¡ï¼ˆLNKãƒ•ã‚¡ã‚¤ãƒ«ï¼‰ 4.ãã®ä»– (1)ãƒ¬ã‚¸ã‚¹ãƒˆãƒªãƒ•ã‚¡ã‚¤ãƒ«ã«ä¿å˜ã•ã‚Œã¦ã„ã‚‹ãƒ‡ãƒã‚¤ã‚¹æŽ¥ç¶šæƒ…å ±ã®ç¢ºèªæ–¹æ³• Windows ã§ã¯ã‚·ã‚¹ãƒ†ãƒ æŽ¥ç¶šã•ã‚ŒãŸ USB æŽ¥ç¶šæ©Ÿå™¨ã®æƒ…å ±ã¯ã€Windows XP / Vista / 7 ã„ãšã‚Œã‚‚ system ãƒ¬ã‚¸ã‚¹ãƒˆãƒªãƒ•ã‚¡ã‚¤ãƒ«å†…ã«ä¿å˜ã•ã‚Œã¦ã„ã¾ã™ã€‚ EnCase ä¸Šã‹ã‚‰ã“ã®ãƒ¬ã‚¸ã‚¹ãƒˆãƒªãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒžã‚¦ãƒ³ãƒˆã—é–²è¦§ã™ã‚‹ã«ã¯ã€C\Windows\System32\config\SYSTEM ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒã‚¤ãƒ©ã‚¤ãƒˆé¸æŠžã—ãŸå¾Œã€å³ã‚¯ãƒªãƒƒã‚¯ãƒ¡ãƒ‹ãƒ¥ãƒ¼ã‹ã‚‰ãƒ•ã‚¡ã‚¤ãƒ«æ§‹é€ ã®è§£æžï¼ˆView File Structure...ï¼‰ã‚’å®Ÿè¡Œã—ã¾ã™ã€‚ EnCase
hasegawayosuke 2010/11/08
forensic

usb
ãƒªãƒ³ã‚¯
ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ» ã‚µãƒ³ãƒ—ãƒ«ãƒžã‚¤ãƒ³ãƒ‰ãƒžãƒƒãƒ—
ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ» ã‚µãƒ³ãƒ—ãƒ«ãƒžã‚¤ãƒ³ãƒ‰ãƒžãƒƒãƒ— [ãƒˆãƒƒãƒ—] [èª¿æŸ»ãƒ„ãƒ¼ãƒ«] [ã‚»ãƒŸãƒŠãƒ¼] [ForensicsAQ] [Forensics MAP] [Ji2 Home] [Ji2 Forensics] ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãƒ»ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»ã«ãŠã„ã¦ã€ä»£è¡¨çš„ãªèª¿æŸ»ã™ã¹ãé …ç›®ã‚’ãƒžã‚¤ãƒ³ãƒ‰ãƒžãƒƒãƒ—åŒ–ã—ãŸã‚µãƒ³ãƒ—ãƒ«ãƒ•ã‚¡ã‚¤ãƒ«ã§ã™ã€‚ ã€æ³¨æ„ã€‘ å…¨ã¦ã®èª¿æŸ»ã™ã¹ãé …ç›®ã‚’ç¶²ç¾…çš„ã«è¨˜è¼‰ã—ã¦ã„ã‚‹ã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€å€‹åˆ¥ã‚±ãƒ¼ã‚¹ã«å¿œã˜ã¦ä¸è¦ãªé …ç›®ã‚„ã€åˆ¥é€”å¿…è¦ã¨ãªã‚‹é …ç›®ãŒå¤šæ•°ã‚ã‚Šã¾ã™ã®ã§ã€ã‚ãã¾ã§é …ç›®æ¡ˆã¨ã—ã¦ã®åˆ©ç”¨ã‚’æƒ³å®šã—ãŸè³‡æ–™ã¨ãªã£ã¦ã„ã¾ã™ã€‚ Windows ç³»ã‚µãƒ¼ãƒã‚·ã‚¹ãƒ†ãƒ ã«ãŠã‘ã‚‹ä¾µå®³ç™ºç”Ÿæ™‚ã®èª¿æŸ»é …ç›®ï¼ˆæ¡ˆï¼‰ãƒžãƒƒãƒ— [pdf] [èª¬æ˜Ž]Windows ã‚µãƒ¼ãƒãŒå¤–éƒ¨ã‹ã‚‰ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãªã©ã‚’å—ã‘ãŸå ´åˆã®ã€ä»£è¡¨çš„ãªèª¿æŸ»é …ç›®æ¡ˆã«ãªã‚Šã¾ã™ã€‚Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãªã©ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å›ºæœ‰ã®èª¿æŸ»é …ç›®ã«ã¤ã„ã¦ã¯å«ã¾ã‚Œã¦ã„ã¾ã›ã‚“ã€‚ Wi
hasegawayosuke 2010/11/08
forensic
ãƒªãƒ³ã‚¯
MiTeC Homepage
This application decodes and analyzes some special files used by Windows OS. In these files is interesting information for forensic analysis. Every analysis results can be printed in user-friendly form. It's designed in Multiple Document Interface. Here are described individual analyzers: Windows XP Thumbnail Database Analyzer This analyzer reads Thumbs.db file and displays its content with stored
hasegawayosuke 2009/12/21
forensic

tool

windows
ãƒªãƒ³ã‚¯
ç¬¬ä¸€å›žãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»ãƒãƒ¼ãƒ ç„¡æ–™ã‚»ãƒŸãƒŠãƒ¼
hasegawayosuke 2009/12/07
forensic

ji2
ãƒªãƒ³ã‚¯
fte | Forensicist
fte(FILETIME Extractor)ã¯ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†ä¸‹ã®ã‚¿ã‚¤ãƒ ã‚¹ã‚¿ãƒ³ãƒ—ã‚’ã¯ã˜ã‚æ§˜ã€…ãªæƒ…å ±ã‚’å–å¾—ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ ç‰¹å¾´ ç§’æœªæº€ã®å€¤ã‚‚å«ã‚æƒ…å ±ã‚’ä¸¸ã‚ãšã«è¡¨ç¤ºã—ã¾ã™ã€‚ å–å¾—ã—ãŸã‚¿ã‚¤ãƒ ã‚¹ã‚¿ãƒ³ãƒ—ã‹ã‚‰å…ƒã®åž‹ã‚’æŽ¨æ¸¬ã—è¡¨ç¤ºã—ã¾ã™ã€‚ NTFSã®å†…éƒ¨ãƒ•ã‚¡ã‚¤ãƒ«($MFT, $ObjID)ã‚„ãƒ•ã‚©ãƒ«ãƒ€($INDX_ALLOCATIONå±žæ€§)ã‚’ãƒ‘ãƒ¼ã‚¹ã—ã¾ã™ã€‚ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ‰ãƒ©ã‚¤ãƒ–ä¸Šã®æŒ‡å®šãƒ•ã‚¡ã‚¤ãƒ«ã®ã‚¿ã‚¤ãƒ ã‚¹ã‚¿ãƒ³ãƒ—ã‚’å¯èƒ½ãªç¯„å›²ã€ç²¾åº¦ã§è¡¨ç¤ºã—ã¾ã™ã€‚ ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ fte_1.8.2.zipÂ (MD5: 7fb35b5e1d6b72304b62fa4dacd6962c) fte_1.8.1.zipÂ (MD5: bc815fbb87d8b4ced19a5e6603493916) fte_1.8.zipÂ (MD5: e4688bdc1ed244224619354760f688fb) ä½¿ã„æ–¹ ã“ã¡ã‚‰ã‚’å‚ç…§ã—ã¦ãã ã•
hasegawayosuke 2009/12/02
tool

forensic
ãƒªãƒ³ã‚¯
http://www.ji2.co.jp/forensics/ForensicsAQ/
hasegawayosuke 2009/11/10
forensic

ji2
ãƒªãƒ³ã‚¯
Anti-Forensic Rootkits
The document discusses anti-forensic rootkits and techniques that can manipulate digital evidence collected through live forensic imaging. It presents DDefy, a proof-of-concept anti-forensic rootkit that intercepts disk read requests and modifies the data returned to hide sensitive information from live forensic tools. DDefy demonstrates that current live imaging methods are insufficient to guaran
hasegawayosuke 2009/11/05
ã‚ã¨ã§

forensic

Windows
ãƒªãƒ³ã‚¯
æŠ€è¡“-MACtimeã‹ã‚‰ã‚ã‹ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«æ“ä½œã€€ï½žMACtimeè¨¼è·¡ãƒªã‚¹ãƒˆã®ä½œæˆã¨ãã®èªã¿è§£ãï½ž
JPCERT-ED-2009-0002 JPCERT/CC æŠ€è¡“ãƒ¡ãƒ¢ ï¼ MACtime ã‹ã‚‰ã‚ã‹ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«æ“ä½œ ï½žMACtime è¨¼è·¡ãƒªã‚¹ãƒˆã®ä½œæˆã¨ãã®èªã¿è§£ãï½ž åˆ ç‰ˆï¼š2009-11-02 (Ver. 1.0) ç™ºè¡Œæ—¥ï¼š2009-11-02 (Ver. 1.0) åŸ·ç†è€…ï¼šå®®ï¨‘ æ¸…éš† æœ¬æ–‡æ›¸ã®æŽ²è¼‰ URLï¼šhttp://www.jpcert.or.jp/ed/2009/ed090002_20091102.pdf æœ¬æ–‡æ›¸ã§ã¯ã€å¤šãã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã«ãŠã„ã¦ãƒ•ã‚¡ã‚¤ãƒ«æ“ä½œã®å®Ÿè¡Œæ™‚åˆ»ã‚’è¨˜éŒ²ã—ã¦ã„ã‚‹ MACtime ã¨ã€ãã®èª¿æŸ» ãƒ„ãƒ¼ãƒ«ã®æ´»ç”¨æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚MACtime ã®èª¿æŸ»ãƒ„ãƒ¼ãƒ«ã‹ã‚‰å¾—ã‚‰ã‚Œã‚‹æƒ…å ±ã¯ã€ãƒ•ã‚¡ã‚¤ãƒ«æ“ä½œã®å®Ÿè¡Œæ™‚åˆ»ã€ãŠã‚ˆ ã³ã€ãã®é †åºã€ã•ã‚‰ã«ã€ãã“ã«éš ã‚Œã¦ã„ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«æ“ä½œã®æ„å›³ã‚„èƒŒæ™¯ã®æŽ¨æ¸¬ã«æ´»ç”¨ã§ãã¾ã™ã€‚ Japan Computer Emergency Response Team
hasegawayosuke 2009/11/02
security

forensic

filesystem
ãƒªãƒ³ã‚¯
2009-02-09
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã®ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»ã§ä½¿ã†ãƒ„ãƒ¼ãƒ«ã¯åŸºæœ¬çš„ã«æµ·å¤–è£½å“ã°ã‹ã‚Šã§ã™ã®ã§ã€æ—¥æœ¬èªžæ–‡å—åˆ—ã®å–ã‚Šæ‰±ã„ãŒæ™‚ã€…ã‚¢ãƒ¬ã ã£ãŸã‚Šã—ã¾ã™ã€‚æœ€è¿‘ã¯ Unicode ã§ãªã‚“ã¨ã‹ãªã‚‹ã‚ˆã†ã«ãªã‚Šã¤ã¤ã‚ã‚Šã¾ã™ãŒã€è£½å“ã®QAéƒ¨éšŠã‹ã‚‰ã€Œä½•ã‚’ãƒ†ã‚¹ãƒˆã—ã¦ãŠã‘ã°ã„ã„ã®ã‹ï¼Ÿã€ã¨ã‹æ€¥ã«èžã‹ã‚Œã‚‹ã¨å›°ã‚‹ã®ã§ã€éŽåŽ»ã®çµŒé¨“ä¸Šã§æ€ã„ã¤ãã“ã¨ã‚’é©å½“ã«ãƒ¡ãƒ¢ã€‚ä¸»ã«é›»åãƒ¡ãƒ¼ãƒ«é–¢ä¿‚ã‚’è€ƒãˆã¦ã¾ã™ãŒã€ä»–ã«ã‚‚ãƒ†ã‚¹ãƒˆã—ãŸã»ã†ãŒã‚ˆã„ãƒ‘ã‚¿ãƒ¼ãƒ³ã¯ã„ã‚ã„ã‚ã‚ã‚‹æ°—ã‚‚ã—ã¾ã™ãƒ»ãƒ»ãƒ» é›»åãƒ¡ãƒ¼ãƒ«ã®é¡Œå(Subject)ãŒã¨ã¦ã‚‚é•·ã„ã‚±ãƒ¼ã‚¹ã ã¨ã€MIMEã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã—ãŸå ´åˆã«è¤‡æ•°è¡Œã«åˆ†ã‹ã‚Œã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ã“ã®ã¨ããƒ„ãƒ¼ãƒ«ãŒè¤‡æ•°è¡Œã«å¯¾å¿œã—ã¦ã„ãªã„ï¼Ÿã¨ã€é›»åãƒ¡ãƒ¼ãƒ«ã® Subject ãŒé€”ä¸ã§åˆ‡ã‚‰ã‚Œã¦è¡¨ç¤ºã•ã‚Œã‚‹ç¾è±¡ã«ã§ãã‚ã™ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ Openmya MLã¨ã‹ã§ã¯çµæ§‹é•·ã„ Subject ãŒå‡ºã¦ãã‚‹ã“ã¨ãŒã‚ã‚‹ã®ã§ã€ãƒ†ã‚¹ãƒˆå‘ãã§ã™ã‹ãï¼ˆç¬‘ï¼‰ Windows ã®ã‚³ãƒ¼ãƒ‰ãƒšãƒ¼ã‚¸ã§ã„
hasegawayosuke 2009/02/09
charset

forensic
ãƒªãƒ³ã‚¯
win32dd v1.2 - ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯æ¥½ã—ã„ã‹ãï¼Ÿ Part 1
hasegawayosuke 2008/11/06
ã€ŒMicrosoftã® Crash Dumpå½¢å¼ã«å¯¾å¿œã€

TOOL

Windows

forensic
ãƒªãƒ³ã‚¯
regripper.net
Click here to enter
hasegawayosuke 2008/09/16
forensic

TOOL
ãƒªãƒ³ã‚¯
Microsoft Corporation
Microsoft Learn. Spark possibility. Build skills that open doors. See all you can do with documentation, hands-on training, and certifications to help you get the most from Microsoft products. Learn by doing Gain the skills you can apply to everyday situations through hands-on training personalized to your needs, at your own pace or with our global network of learning partners. Take training Find
hasegawayosuke 2007/12/03
ã‚ã¨ã§èªã‚€

Microsoft

forensic
ãƒªãƒ³ã‚¯
1