Mass Digital Forensics & Incident Response with Velociraptor
Source: YouTube · John Hammond · published Jul 17, 2023 · 34:55
Velociraptor is a powerful digital forensics and incident response tool that automates traditionally manual investigation processes 0:00.
Key Takeaways:
• Velociraptor's Virtual File System (VFS) enables interactive file browsing, but artifacts are more efficient for scale forensic investigations 1:57
• Artifacts automate data collection, such as the SQL Hunter artifact that finds and parses all SQLite files across multiple browsers automatically 4:00
• The process tracker feature captures processes even after they've exited, allowing investigators to see the full attack chain including reconnaissance activities 13:40
• NTFS forensics, like analyzing the USN journal, helps detect specific attacker activities such as PSexec lateral movement by finding unique file artifacts 19:57
• Hunting across multiple endpoints enables rapid identification of compromised systems by analyzing service installations and finding anomalies across the network 29:27
Velociraptor transforms digital forensics by automating repetitive tasks, allowing investigators to focus on complex attack analysis rather than manual data collection.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
is the challenge for users is kind of figuring out what Search terms to use or or what to use and like for me I call it calculator content where like you just take content that's already written and then you modify it slightly to make it kind of how you want it like you add a calculator to it right alrighty well hey thanks so much for tuning in everyone uh checking out the video here but look I am stoked super excited and just flattered to be having an opportunity to chat with these two fine folks I have with me uh Michael Cohen the like creator of velociraptor phenomenal and hey super glad to have you here and alongside of Matt Matt Greene over both these folks at rapid7 doing digital forensics incident response um but we got an opportunity to just get together and I thought that would be…