Webcast Replay – How to Identify Timestomping Using KAPE

Name: Webcast Replay – How to Identify Timestomping Using KAPE
Start: 2022-06-15

June 15, 2022 | (Online)

Join Kroll's Andrew Rathbun as he walks through how to detect Timestomping using KAPE.

Watch the Webcast Replay

Timestomping is a common anti-forensic tactic that threat actors use in order to hide their tools on a victim’s file system. Detecting and analyzing timestomping can be time-consuming for examiners, but with a combination of the Kroll Artifact Parser and Extractor (KAPE), MFTECmd and Timeline Explorer, the process is expedited, allowing examiners to focus on data instead of worrying about parsing files.

In this session, Kroll expert Andrew Rathbun demonstrates how to use KAPE, MFTECmd and Timeline Explorer to acquire, parse and analyze an $MFT file to detect timestomping.

This webcast covers:

The basic KAPE workflow, calling MFTECmd via KAPE Modules
The benefits of MFTECmd
How to collect and parse the $MFT with KAPE and MFTECmd
How to detect timestomping in the parsed $MFT with Timeline Explorer

Download the webcast slides here.

Stay Ahead with Kroll

Cyber and Data Resilience

Incident response, digital forensics, breach notification, security strategy, managed security services, discovery solutions, security transformation.

Cyber and Data Resilience

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

24x7 Incident Response

Data Recovery and Forensic Analysis

Kroll's expertise establishes whether data was compromised and to what extent. We uncover actionable information, leaving you better prepared to manage a future incident.

Data Recovery and Forensic Analysis

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Cyber Risk Retainer

Computer Forensics

Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.

Computer Forensics

Data Collection and Preservation

Improve investigations and reduce your potential for litigation and fines with the strict chain-of-custody protocol our experts follow at every stage of the data collection process.

Data Collection and Preservation