Alternate Data Streams

Quick writeup on Alternate Data Streams (ADS). ADS is a file attribute used in NTFS that ultimately provides an opportunity for investigators to extract valuable evidence that might otherwise be overlooked. ADS is an additional stream of data that can be attached to a file on Windows systems. It’s a hidden file attached to a […]

Create a Personal Forensics Lab Part 5: The Windows 7 Workstations

By this the fifth instalment of the ‘build your own lab’ series, the lab already resembles this network diagram (or should, anyway): As the title suggests, it’s time to install the Windows 7 workstation(s). Workstation Configuration During the installation, Windows asks for a user name and a Computer Name. Enter these to save a step […]

Vultr and Virtio Part 2 – Creating Your Custom VM

At this point, you have already created your custom Windows ISO and are now ready to use said ISO to spin up a VM. Deploy Your Windows Server Login to your Vultr account From the Servers area, click Deploy New Server: Choose any server location you desire Under Server Type, select Upload ISO and then the ISO which you […]

Vultr and Virtio Part 1 – Creating a Custom Windows ISO

In the past, I’ve had difficulty creating Windows virtual machines with Vultr and other VPS providers which require the creation of a custom ISO that includes the virtio drivers. To remedy this, I decided to write a how-to on the process, so I’d be able to follow it again in the future. Hopefully, others will find […]