<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>IR and forensic talk &#187; Windows Analysis</title>
	<atom:link href="http://blog.kiddaland.net/category/forensics/windows/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.kiddaland.net</link>
	<description>Some useless talk mixed with hopefully interesting points every now and then</description>
	<lastBuildDate>Wed, 30 Jun 2010 13:14:25 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>timescanner and IE history</title>
		<link>http://blog.kiddaland.net/2010/04/timescanner-and-ie-history/</link>
		<comments>http://blog.kiddaland.net/2010/04/timescanner-and-ie-history/#comments</comments>
		<pubDate>Mon, 26 Apr 2010 12:43:13 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[Windows Analysis]]></category>
		<category><![CDATA[index.dat]]></category>
		<category><![CDATA[internet explorer history]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[timestamps]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=249</guid>
		<description><![CDATA[There has been some discussion lately about some limitations to timescanner in regards to the reading of timestamps in various index.dat files.  More precisely Windows decided that it would store timestamps using different timezones depending on the location of the index.dat, instead of sticking with the good old UTC format.  So for instance the history [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/04/timescanner-and-ie-history/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Malware analysis</title>
		<link>http://blog.kiddaland.net/2009/11/malware-analysis/</link>
		<comments>http://blog.kiddaland.net/2009/11/malware-analysis/#comments</comments>
		<pubDate>Thu, 19 Nov 2009 11:50:47 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Windows Analysis]]></category>
		<category><![CDATA[analysis]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[pdf]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=158</guid>
		<description><![CDATA[I decided to to some malware analysis as a part of some presentation I had to do.  And since I went through the process, I decided to post it here if anyone is interested. To begin with, I needed to find some malware to analyze.  And a great place to find live links to active [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2009/11/malware-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>log2timeline, artifact timeline analysis &#8211; Part I</title>
		<link>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/</link>
		<comments>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/#comments</comments>
		<pubDate>Sat, 01 Aug 2009 09:11:24 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Network Analysis]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[Windows Analysis]]></category>
		<category><![CDATA[artifact analysis]]></category>
		<category><![CDATA[artifacts]]></category>
		<category><![CDATA[body file]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[mactime]]></category>
		<category><![CDATA[timeline]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=70</guid>
		<description><![CDATA[Update 1 Updated one command (according to a comment) and text regarding availability of comparable tools updated according to a post that I just posted on the SANS forensic blog &#160; Timeline analysis can be extremely useful during any investigation.  Although traditional file system timeline can be very helpful it sometimes misses important events that [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Windows Prefetch Directory</title>
		<link>http://blog.kiddaland.net/2009/06/windows-prefetch-directory/</link>
		<comments>http://blog.kiddaland.net/2009/06/windows-prefetch-directory/#comments</comments>
		<pubDate>Mon, 08 Jun 2009 11:58:45 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Windows Analysis]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=23</guid>
		<description><![CDATA[The Prefetch folder in Windows contains information about last run software on a Windows machine.  It can be very valuable to examine the content of the prefetch directory (can be found at %WINDIR%/Prefetch, usually either C:\WINDOWS\Prefetch or C:\WINNT\Prefetch) to find clues about which software has been recently run on the system. To be able to [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2009/06/windows-prefetch-directory/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Restore Point Analysis</title>
		<link>http://blog.kiddaland.net/2009/06/restore-point-analysis/</link>
		<comments>http://blog.kiddaland.net/2009/06/restore-point-analysis/#comments</comments>
		<pubDate>Mon, 08 Jun 2009 10:10:09 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Windows Analysis]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=18</guid>
		<description><![CDATA[Recently I wanted a small script to read the content of the restore point directory (C:\System Volume Information\_restore{GUID}) and read all the rp.log files that are inside the directory and print out a list of all the restorepoints, when they were taken and what the reason was. So I wrote this script here to do [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2009/06/restore-point-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
