WindowsSCOPEA new version of WindowsSCOPE Cyber Forensics is now available. WindowsSCOPE version 3.2 now includes support for the latest versions of Windows operating systems through Windows 10. Also included with version 3.2 is WindowsSCOPE’s data…
read more
This article will show how you can use the ThreatSCOPE feature of WindowsSCOPE to detect rootkits installed on a system. One of the difficulties in detecting rootkits and other advanced malware is that they’re often…
read moreThe latest addition to the WindowsSCOPE product lineup, Cyber Forensics Ultimate, is now available at the online store. This new version incorporates all the interactive features of previous versions, including system-wide disassembly and control flow…
read moreWindowsSCOPE now offers PCI Express and ExpressCard platforms capable of imaging physical memory and providing other cyber security related capabilities even in locked computers. CaptureGUARD Gateway can be customized for various advanced cyber security and…
read more
Live memory acquisition is becoming increasingly important for digital investigations. One of the biggest obstacles with memory acquisition, however, is that in many cases a computer under investigation is locked, requiring a password that is…
read moreTwo new tutorial videos are now publicly available on the WindowsSCOPE websiite – “Using WindowsSCOPE to Investigate 64-Bit Virtual Memory Management” and “Using WindowsSCOPE to Analyze the Shadow Walker Rootkit”. With 64-bit computers becoming increasingly…
read more
If you followed our prior post on the Vanquish rootkit, you might remember how we identified anomalies in a system that led us to finding a Vanquish rootkit infection. You can go back to Part…
read more
The first warning sign that we noticed in this snapshot was in the process for cmd.exe (this is for a Windows command line window). See below for a screenshot of the contents of this process:
read moreYou can access the video here.
read more
Step 1 – Setting up your WindowsSCOPE Live Server The first step in getting WindowsSCOPE Live running is to download and install the WindowsSCOPE Live server. You can get the server on the WindowsSCOPE downloads…
read more