MetaDiver 2.1.6 released

MetaDiver v2.1.6 has been released. This build fixes a bug in email mappings.

Download

by Dave via EasyMetaData.com

MetaDiver 2.1 has been released #metadata #data #dfir #infosec

I’m excited to announce that MetaDiver 2.1 has been released! This is close to a full rewrite with better scalability. The ability to review metadata in MetaDiver has been greatly improved. The back-end has been rewritten to use SQLite. Many new documents are now handled including email archives,  Windows Shortcuts including lnk and jumplists, legacy doc 97 and archives.

Changes in 2.1

-Backend rewrite to SQLite
-Email header support added: MSG, PST, EML, EMLX.
-Email extended MAPI added – some extended mapi header information being added
-Legacy office doc’s ’97 support
-Windows Shortcut parsing LNK and Jumplists enumeration
-Archive enumeration (zip, 7z, arj, rar, gzip, bzip2, iso, vhd, vhdx, vmdk, cab)
-Command line version (basic functionality)
-Improvements to error handling when file permission denied (Users like to select the entire partition, click and forget…)
-large dataset support using paging.
-openxml office mapping bug fixes
-exif: bug fixes
-exif: user comments decoding hex added
-logging rewrite
-fixes for IO handling reparse and permission denied when reading full drive.
-Review form: panel’s are now sizeable
-Review form: column width’s are remembered
-Case path added
-UI improvements
-various bug fixes

by Dave via EasyMetaData.com

Demystify Windows 10 – Tips, Tricks & Privacy?

So Windows 10 is out and I really like it so far. I’ve taken a few notes to help you on your journey. I’ll post more as I learn more.

1. You can defer upgrades and change how updates are installed to schedule a restart.

I’ve read multiple articles with the author complaining about updates being forced… This is not entirely the case.

To change the settings look under Settings -> Update & Security -> Windows Update – > Advanced Options. (Super easy). Change the selection for “Choose how updates are installed” to “Notify to schedule restart“.

Going forward Windows will be ask to schedule the next reboot instead of it happening automatically. This sounds very similar to Windows 7 and Server 2008 behavior.

2. Privacy – You should review these settings

Review your privacy settings because the default settings can send send a lot of information!

For example, Under Feedback & diagnostics take a look at Diagnotics and usage data. By default this is set to send a Full report. You can change this to Basic or Enhanced.

3. Speech, inking, & typing – if you read the description here it might raise hairs on your neck. My computer is going to listen to me and learn my writing?

If you aren’t cool with that turn it off. Sure sounds like what they are saying is statistics about me is going to the cloud to get analyzed for my own personal happy assistant. On the other my little digital assistant will eventually know me better than myself right?

4. You can send documents to different devices under Settings -> Storage

So say your C: drive is low on space you can set video’s to that extra drive while keeping pictures on your c: drive. Pretty cool feature.

5. Make text bigger (my favorite).

Scaling is much improved. Just go to Settings -> Display and you can just move the slider to the size you want your text to be. This is great for those of us with tired eyes and bad vision.

6. Sync Settings (are you sure???)

A really convenient feature introduced in Windows 8 and still going strong in Windows 10 is sync settings under Settings -> Accounts -> Sync your settings. It will sync your preferences, Windows settings, browser preferences and passwords.

@#@!#$%, what?, I’m hesitant to replicate what I do at home on another computer. Call me paranoid, but really, I’m not paranoid…I’m just informed. If you value your privacy then keep your settings, preferences and what you do on that PC at the PC and don’t sync them. The same goes for Chrome. If you log in to your browser you activity is going with you!

7. My Computer shows Recent files

I noticed was the replacement to My Computer shows Recent files you accessed automatically. This is really helpful to a user trying to remember the last few documents the had open before gorging at lunch and accidentally closing every program they had open when they got back to their desk after lunch.

For instigators it’s even more helpful. Sure, Recent files aren’t new but these MRU’s (most recent used) will be gold mines.

by Dave via EasyMetaData.com

MetaDiver: What’s coming in Alpha 3

The next alpha release of MetaDiver is coming together nicely.

Lots of new features in the works. Major new features being added. I’m still coding, plus better testing on various Windows environments before I put it out there for you to break further. I plan to post open source projects relied upon to github in accordance with individual license requirements and will be acknowledged and linked from the app. Some features will eventually be migrated to a paid version once I have time to do all of that.  For now though enjoy the free candy.

New features coming with v2.0.2 Alpha 3:

• Email support – read headers (MSG, PST, EML) – including extended mapi goodies
• Email – export to file (MSG or EML)
• Windows shortcut parsing LNK and Jumplists
• Legacy office doc’s ’97-2003 support added
• Archive file enumeration (zip, 7z, arj, rar, gzip, bzip2, iso, vhd, vhdx, vmdk, cab)
• Column width’s are remembered using sqlite settings database
• Review form: panel’s are now sizeable
• Transition to SQLite backend
• Improvements to error handling when file permission denied (Users like to select the entire partition, click and forget…)
• OpenXml document mapping bug fixes
• DPI scaling improvements
• Datagrid large dataset support for reviewing large amounts of information!
• Various bug fixes and UI improvements
• Other stuff I have forgotten

-Dave

If you have thoughts about MetaDiver you think would add value then please let me know! You can contact me on Twitter via direct message or just comment on this post.

by Dave via EasyMetaData.com

Github: My open source projects are being added

Github account created with open source projects being added.

http://ift.tt/1JhFL9M

 

by Dave via EasyMetaData.com

MetaDiver 2.0 Alpha2 released #dfir #ediscovery

The MetaDiver 2.0 Alpha2 has been released and available for download.

http://ift.tt/1Ke2KRX

• Resolved crash on Windows Server 2008 due to VisualBasic PowerPack not installed with .Net on servers.
• Various minor bug fixes and UI changes.

by Dave via EasyMetaData.com

Improving Windows External Device Investigations [updated] slides posted from #CEICCONF #DFIR

My slides for the talk I gave at CEIC 2015 on Improving Windows External Device Investigations have been uploaded. You can download them below.

Download: Slides for Improving Windows External Device Investigations

by Dave via EasyMetaData.com