cab files are created, and you can then run a diff between the two of them. After you do something.install or update an app, for example.you rerun the tool. Okay, so here's what the tool does.you install the tool and run a baseline of the system. I did some looking around with respect to this tool, and while there are lot of 'retweets', there isn't much out there showing its use. Troy Larson reached to me the other day to let me know that MS had released the beta of their Attack Surface Analyzer tool. Chris is really working hard to make ProDiscover a valuable resource. These are just some of the capabilities he mentioned, and there are more updates to come in the future. The image compare feature in the last update is very cool for getting the diff's on volume shadow copies.Īdded support for Linux Ext4 file system. This means that users can add any bitlocker protected disk/image to a project and perform all investigative functions provided that they have the bitlocker recovery key. Further down the page, ProDiscover Basic Edition (BE) v 6.8 is available for download.BE now incorporates the Registry, EventLog and Internet History viewers.Ĭhris also shared with me that PD v6.8 (not BE, of course) includes the following:Īdded full support for Microsoft Bitlocker protected disks on Vista and Windows7. There's also a webinar available that demonstrates this. First off, there's a whitepaper that demonstrates how to use ProDiscover to access Volume Shadow Copies on live remote systems. If you go to the Resource Center, you'll find a couple of things. This may not interest a lot of folks but if you haven't kept up with PD, you should consider taking a look. Chris Brown has updated ProDiscover to version 6.8.
0 kommentar(er)
