ogmini - Exploration of DFIR

Having fun while learning about and pivoting into the world of DFIR.

About Blog Research CTF/Challenge GitHub RSS
19 January 2025

Second Week Musings

by ogmini

It has been a busy week with multiple big changes on the horizon. Definitely feel like I have too many irons in the fire. Hopefully by next month, I can talk about them. Still fighting that imposter syndrome. What have I been able to accomplish this week though?

I was able to carve out sometime to take on David Cowen’s challenge and my submission was picked! https://www.hecfblog.com/2025/01/daily-blog-721-solution-saturday-11825.html

There are a few aspects of my answer and what I found that bother me. I’m hoping to continue exploring SRUM to get a better understanding of its operation. I noted these in my post as areas of future interest:

  • SRUM records stored in the Registry prior to flush
  • Errors from RegistryExplorer / SrumECmd / any tool that uses the RegistryHive library from Eric Zimmerman
  • ForegroundNumberOfFlushes - something about it still bothers me. I want to perform more testing on this.
  • Try to figure out how to isolate SRUM data as much as possible

I’ve made no progress on my Notepad State Library or associated projects as I got sidetracked by exploring MSLab. I also started the build on a new server.

tags: musing