(Apostle) Monkey Life

I have been looking into the execution artifacts on windows systems over the past few weeks to see not only what artifacts a system may create which may indicate execution, but what the original purpose of these artifacts to get a better understanding of why they exist in the first place and how reliable that makes them. There are a lot of documented artifacts which are useful in forensic investigation: AppCompactCache (ShimCache) amcache prefetch MUICache UserAssist prefetch and superfetch IconCache SRUDB Windows Event Logs The way I like to get to know artifacts and methodology on collecting and interrogating them is through experimentation. I will look into the above and provide some future posts on what they are and how you can use them in forensic investigations. 

How do users know if mobile app communications are secure? Consumers are using mobile applications more and more these days; Shopping, Banking, Blogging etc. The public have been informed about general security best practice for some time now, one of the simple and most common pieces of advice has been "check for the padlock". This has been trying to make people aware of encryption when doing internet based transactions which require/desire privacy. OK, so most people still don't know what they are looking for, if people even care to check, they will look for 'https' and check that the padlock or address bar are green. Some may go as far as checking the certificate details. Assuming that this is becoming a normal check performed by users to provide some self assurance that whatever they are doing is encrypted, how are users meant to be doing this for mobile apps? Smart phone apps which are created with some sort of online functionality; banking apps,...