42 LLC will be speaking at Guidance Software's Computer Enterprise Investigations Conference in Orlando, FL. Anyone interested in attending one of the 42 LLC sessions should register through the conference website, http://www.ceicconference.com/. Here is a list of the sessions that 42 LLC will be giving:
Malware Reloaded
(Yogesh Khatri)
The revolution of Web 2.0 has brought with it the evolution of malware to the next level. Last year we hacked away at simple web based malware. This year we will do a refresher of those techniques and tools, as well as cover some more advanced analysis methods and focus on newer attack vectors. This session will be advanced for most, but those with experience reverse-engineering malware and preforming incident response may find it intermediate.
*NIX Environments
(Chris Pavan & Gordon Stephens)
Unix and Linux (*NIX) environments have been around for quite some time, but are starting to become more popular. There is an ever growing number of products, servers, and systems that run some form of *NIX operating system. To someone who does not have any experience with these systems, conducting and examination of one can be quite difficult. With a little background and some info to get you started you will find *NIX examinations significantly easier than that of a Windows computer.
We will discuss some of the major versions like Solaris, Debian, Red Hat, and Darwin, differences between them, and issues you may run into. We will also cover imaging techniques using LinEn and dd over a network. This is a basic to intermediate session directed towards those with little to no *NIX experience. Experienced *NIX users should consider another session as this one will most likely repeat what you already know.
EnCase Tips and Tricks
(Chris Pavan & Nick Ringold)
Back by popular demand and overwhelmingly positive feedback is the Tips and Tricks lab. This year we are going to dive deeper into Windows and EnCase environment settings, as well as covering some often overlooked functionality of EnCase. Overall the session is designed to make the Examiner’s life easier when using EnCase. We will also be including a quick reference sheet that covers the key information presented in the session, as well as some EnScripts.
This is a basic to intermediate session that will repeat some, but not all, of the information from last year. If you are new to using EnCase, need a refresher on optimizing Windows and EnCase performance, or just want to see EnCase from our perspective, then this is the session for you. For those of you who are advanced Windows users and EnCase Ninjas you may find this session repetitive.
