We had a jam packed Forensic Lunch today with a portion of the Google IR team today talking all about the open source tools they develop, use and support in their work at Google.

Specifically we had :

• Mikhail Bushkov giving a big update on GRR https://github.com/google/grr
• Johan Berggren (https://twitter.com/jberggren) and Kristinn Gudjonsson (https://twitter.com/el_killerdwarf) talking about Timesketch and Data science
• • https://github.com/google/timesketch
• Aaron Peterson (https://twitter.com/aarontpeterson) talking about Turbinia
• • https://github.com/google/turbinia
• Thomas Chopitea (https://twitter.com/tomchop_) talking about DTTimewolf
• • https://github.com/log2timeline/dftimewolf
• Theo Giovanna talking about libcloudforensics aka cloudforensicutils
• • https://github.com/google/cloud-forensics-utils/tree/master/libcloudforensics
• Joachin Metz (https://twitter.com/joachimmetz) - Talking about Plaso, libntfs and Libyal
• • Plaso: https://github.com/log2timeline/plaso 
  • Libfsntfs: https://github.com/libyal/libfsntfs
  • Libyal: https://github.com/libyal

Join them on the Open Source DFIR Slack: https://join-open-source-dfir-slack.herokuapp.com/

Read more about what they are doing on the Open Source DFIR Blog: https://osdfir.blogspot.com/

  Today on the Forensic Lunch we only had one guest, Zach Wasserman, from OSQuery technical steering committee. We only had one guest because we knew we would have so much to talk to Zach about! From OSQuery's future in the linux foundation, Kollide Fleet and other fleet managers to Zach's work at Dactiv, LLC you have alot waiting for you in this weeks broadcast.

You can reach Zach Wasserman on twitter @TheZachW or Zach can be reached at zach@dactiv.llc if you want to work with him!

What a great Forensic Lunch today!

On today's broadcast we had:

Yuri Gubanov (@belkasoft) giving an update about whats going on at Belkasoft. Including their IOS 13.4 full file system acquisition using Checkm8, their new IR module in Belkasoft Evidence Center and a neat capability to do managed remote logical phone collections.

Steve Gibson and Spencer Hendee (@stevegibson) from KPMG (disclaimer I work there too!) came on to discuss the really cool AWS Cloud IR Automation we've been working on.

Brian Moran (@brimorlabs) social media maven and principal of BriMorLabs came on to discuss the Magnet Virtual Summit DFIRFIT 2020 where for a donation (and some excercise) you can get a cool prize pack shipped to you anywhere in the world! Register here: https://mvsdfirfit2020.com

Caleb Queern (@HttpSecHeaders) also of KPMG came on to discuss the clearsite HTTP header. This was interesting as its a directive a website can give to a browser to tell it to clear/not store history or data about it. This will need to be tested, you can read more here https://w3c.github.io/webappsec-clear-site-data/

So great stuff this week, you can watch below. Otherwise next week we've already confirmed Zach Wasserman to come and talk about OSQuery and Kollide!

On this episode:

• Mari Degrazia (@MariDegrazia) discussing her research into WinSCP and later movement, you can read more here: http://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html
• Hal Pomeranz (@hal_pomeranz) talking about his new Linux Forensics course that you can download here: https://ia801406.us.archive.org/6/items/HalLinuxForensics/HalLinuxForens ics_archive.torrent
• Alex Levinson (@alexlevinson) Gave an update on the National Collegiate Cyber Defense Competition which as gone all virtual this year
• Matt Seyer (forensic_matt) talked about our upcoming SANS DFIR presentation and tools he's working on
• Sarah Edwards (@iamevltwin) gave colorful commentary and meaningful insights 

Live with Rick Holland, Ryan Johnson and Evan Dygert

The Forensic Lunch!

This week with the Champlain Digital Forensics Association talking about the Defcon DFIR CTF
and Martin Korman talking about his project regipy

This week with Alex Levinson from Uber

The Forensic Lunch!

Sli.do link https://app2.sli.do/event/hzkazryr/live/questions

This broadcast we are doing a live AMA from Reddit all about the NCCDC Redteam

The Forensic Lunch!

Live from the Magnet User Summit 2019!

with Lance Spitzner talking about Sans Live Online, Jessica Hyde talking about the Magnet Virtual Summit

The Forensic Lunch 3/8/19!
The twice a month, usually, podcast/videocast that's all about DFIR
This week we have:
Eric Zimmerman, talking about KAPE
Lee Whitfield, talking about the Forensic 4Cast award nominations

Forensic Lunch ANZAC edition with Michael Cohen talking about Velociraptor

Shanna Daly talking about her work in Australia

Phil Moore, Nick Klein talking about their new entity and thisweekin4n6

Forensic Lunch with Sarah Edwards, Ashley Hernandez , Dr Joe Sylve catching us up with the new combined Celebrite/Blackbag

The Forensic Lunch 2/1/19!
The twice a month, usually, podcast/videocast that's all about DFIR
This week we have:
Blanche Lagny talking about her paper on Amcache
The DFIR Review crew talking about .. DFIR Review!
crew entails:
Jessica Hyde
Vico Marziale
Brett Shavers
Tony Knutson

Forensic Lunch! Live with Ryan Benson talking about Unfurl, Jessica Hyde and Aaron Sparling talking about Memory forensics

This week Lee Whitfield joins us to discuss the DFIR Summit and Matt showed us his rust based live windows monitors for DFIR Research