The story of greendale

Presented at BruCON 0x0A (2018), Oct. 5, 2018, 1:30 p.m. (180 minutes).

Ever wanted to do forensics and feel good about it? This workshop will introduce you to a suite of open-source tools for all things digital forensics and incident response. You will see how Greendale (a fictitious but very famous university) used this set of tools to articulate an effective response to a pretty severe incident last summer—all on a state-financed university budget! We will cover collection of forensic evidence with GRR, processing with Plaso, and analysis with Timesketch; how these tools can be articulated using dftimewolf, how to remotely image disks and have the processing done in the Cloud.

Presenters:

• Thomas Chopitea
  Thomas is a forensics investigator and engineer at Google. He focuses on digital forensics, incident response, and building the bricks that make his team’s investigation and response process as smooth and efficient as possible. His long-term professional goal is to automate himself out of a job.
• Daniel White
  Daniel White is a security engineer at Google and the tech lead for the Plaso project. He is focused on keeping people and data safe. He works on forensics, incident response and tool development.

Links:

• https://brucon0x0a.sched.com/event/FXIY/the-story-of-greendale

Similar Presentations:

• DEF CON 18 (2010) / Sniper Forensics - One Shot, One Kill
• Texas Cyber Summit 2019 / TH-1015 Finding the Rogue Node
• DerbyCon 3.0 All in the Family (2013) / DIY Forensics: When Incident Response Morphs into Digital Forensics