Well done is better than well said.

Virtualization and Forensics: A Digital Forensic Investigator’s Guide to Virtual Environments by Dianne Barrett and Gregory Kipper is a book packed with information. Unlike my last Syngress book review on Digital Triage Forensics by Stephen Pearson, this book is entirely relevant to computer forensic analysts and I vaguely recommend it.

In the field of digital forensics, there are some books that you have on your shelf and hope to reread every year, (File System and Forensic Analysis by Brian Carrier), and there are books you keep for reference. Virtualization and Forensics is packed with information about virtual machines, the environments they run in, the vendors making the applications, and how they apply to forensic investigations, but it’s more of a reference book as it provides artifacts of virtual machine and evidence that one was run.

Virtualization and Forensics (VAF) covers the details of many virtualization applications, including VMware Workstation (and Fusion for Macs), Parallels, Microsoft Virtual PC MojoPac, MokaFive, and probably some others I had never heard of. VAF covers the artifacts left behind for each of these program installations, as well as their server versions. At this point you may be asking yourself ‘If it’s such a great book, why did he put ‘vaguely’ in the recommendation sentence?” That’s a good question!

VAF leaves out some critical information that I fault it for not including because of it’s title. This book is short for something covering such a massive (and popular) topic; virtualization was identified as the #1 Strategic Technology for 2009 by Gartner, the IT industry’s largest and most-strategic conference. The title of VAF includes “Investigator’s Guide”, but I have to disagree as there is just a surface being scratched here. The authors ran some tests and provided us the results of those tests, but didn’t offer anymore thought than that. The authors have a thorough understanding of virtualization and appear involved in researching the topic as they know all the white papers and research to reference. Read more

Towards the end of 2011 I was nearing graduation for my Master’s degree in Digital Forensics from the University of Central Florida and I was looking to further bolster my resume by adding more “keywords” to it. Rather than having just Windows and Linux, I wanted to add Mac to the list, so I bought a Macbook Pro. When is the best time to buy a Mac? Purchasing on Black Friday got me a nice discount, which was then even improved upon by Amazon. Without the student discount, their pricing was still lower than Apple’s with the student discount (Apple charges for shipping).

So the Mac arrives and it works. A few weeks in and I have no sound. What is going on here? Aren’t these things supposed to be the best computers out there and Windows sucks, yadda yadda yadda? Apparently not, because I have no audio!

Not knowing much about the workings of an Apple laptop, I do what I would in Windows, I open up the Task Manager, or Activity Monitor on a Mac. To do this, go to Launchpad > Utilities > Activity Monitor. (There is no shortcut to Activity Monitor, but you can create one or use Spotlight by pressing Command + Space, then start typing Activity Monitor. By default, Activity Monitor opens with My Processes displayed; I don’t want My Processes, I want All Processes, because it’s going to be running at the system level.

Activity Monitor has a great feature in the upper right, next to the dropdown to select All Processes, called a search filter. If you search for sound, nothing appears, BUT if you search for audio, you get one process: coreaudiod. Notice that the user is _coreaudiod, so this would not present itself if we were searching in My Processes.

Read more

I’m very excited to announce that I will be upgrading this website to my own unique layout with an amazing personal branded logo. I think the logo turned out great, let me know what you guys think.

The logo and layout are being designed by Logiq Design. Truly a job well-done!