For the first time in quite a while I'm pretty excited. Just last week Matt Shannon released F-Response. F-response looks like it may shape up to be the best tool in my arsenal. Not because it makes analysis easier but because it facilitates analysis where it wasn't possible before and it does so in such a brilliant way that I'm just amazed. It also allows responders or examiners the opportunity to use the bulk of their toolkit safely and without the immense impact that many of our tools have on systems. When I've taught classes I specifically instruct people NOT to run AV, backups, and the other things that people like to execute to "investigate". This tool re-opens that door and can allow a first responder to actually respond to the incident, analyze with their typical toolset, and escalate when needed.
I'll be writing quite a bit about this tool and what can be done with it because I am just that excited about it.
skip to main |
skip to sidebar
This blog was created to support some of the work I'm doing and to contribute to the forensic community. I'll be blogging about the science of forensics, incident response, methodologies, relating real world investigations to digital ones and some other tidbits.
Skydrive
Access my skydrive for memory dumps.
HERE
Email Address
hogfly at gmail dot com
Most visited sites
- A day in the life of an Information Security Investigator
- Attack Research
- Binary Intelligence
- CFED
- Computer Forensics, Malware Analysis & Digital Investigations
- CyberSpeak Podcast
- Dancho Danchev
- Dark Visitor
- E-Evidence
- Evil Bytes
- ExForensis
- F-response
- FireEye Malware Intelligence Lab
- Forensic Focus
- NIST SP-800 series
- Offensive Computing
- TaoSecurity
- TED - Ideas Worth Spreading
- Volatility
- Windows Incident Response
Currently reading - recommend a book by email
- Cyber War
- Decoding the Virtual Dragon
- Mind of War
- On War
Visitor map
6 comments:
I'm curious.
Does F-response work like Logicube's Phantom?
Bernard,
Nope it's very different from the phantom and talon. It's software for starters and it's network based.
The more awesome it is, the more disappointed I'm going to be that they are trying to get a patent on it, preventing similar open source software.
Anonymous,
There's nothing wrong with patenting a novel idea and the methodology is there?
My hope is that they don't get swallowed by another company...like Guidance or AccessData.
No, I'm not blaming them for it at all. I can understand why they did it, I just wish there could be an open source version as well...
...the more disappointed I'm going to be that they are trying to get a patent on it, preventing similar open source software.
I'm not sure I follow...how is getting a patent preventing someone from coming up with their own novel, albeit open-source, solution?
Post a Comment