Why

When

How

Mari DeGrazia, Director at Kroll Cyber Security

az4n6.blogspot.com

github.com/mdegrazia

@MariDegrazia

Accurate results

Tools are not perfect

Lead to false results

Hot Seat

Vague column headings

Missing time zone information

Parses partial data

New OSNew Tool

NIST

Real World

Generate

*Test data provided by Eric Zimmerman’s Blog Post: https://binaryforay.blogspot.com/2016/05/appcompatcacheparser-v0900-released-and.html

*Test data provided by Eric Zimmerman’s Blog Post: https://binaryforay.blogspot.com/2016/05/appcompatcacheparser-v0900-released-and.html

0x0080

0x0088

Know your artifacts

Check release notes

Check github issues

Let developers know

Share your test results