This month we will have a presentation from Pär Österberg Medina who recently did a write up on acquiring those pesky "locked" files from live Windows systems. This will be an on going challenge for DF/IR responders as we come across systems that can't go down. The angry look the admin will give you when you tell him one of his systems will have to power off for collection will make you appreciate alternatives.

Windows systems offer a variety of special files that contain important pieces of information that are useful in a forensic investigation. Some obvious examples include the pagefile.sys, event log, registry hives, and NTFS-specific files such as the Master File Table ($MFT). It is a common misconception of many forensic investigators and incident responders that collecting these special files from a live system is cumbersome and impossible to do via the command line. This presentation will demonstrate several ways we can bypass the protection mechanism that Windows holds on these files, making it possible to include them in our data acquisition from a running system.

Pär Österberg Medina has worked with computer security for over 15 years. Having a background in both system administration and penetration testing, he currently works as an Incident Response Consultant for McAfee and Foundstone Professional Services, specializing in Malware Analysis and Memory Forensics. Prior to joining Foundstone, Pär spent the last 8 years working as an Incident Handler, investigating computer intrusions and coordinating security related incidents for CERT-SE, the national Computer Security Incident Response Team for Sweden.

So please join us on Wednesday November, 16th, 7:00pm at John Jay College of Criminal Justice, 899 Tenth Avenue (59th St. and 10th Ave.) in Room 630T for this exciting meet-up.

Big thank you as always for John Jay College of Criminal Justice for being such gracious hosts for NYC4SEC! Check out the list of upcoming events on The Center for Cybercrime Studies website:

http://www.jjay.cuny.edu/centers/cybercrime_studies/index.php