Pipe Notes

I’ve been on leave for surgery recovery for the past week with another one to five more to come. The office/lab has converted nicely to a recovery room. Needless to say there hasn’t been a lot of DFIR going on.

The requirement to be as sedentary as possible has given me good time to focus on mindfulness and my other favorite breathing activity, pipe smoking.

That’s right, it’s not just a logo, I’ve enjoyed smoking tobacco pipes for years. That said, smoking is bad for you and if you haven’t started I can’t say that I’d suggest it. If you do decide to, at least use the good stuff. Life’s too short to smoke $#!%.

Like my bourbons, I have my tobacco staples that I stick to, but I also like to try new varieties. As would be expected, not all deliver on their descriptions and I’m left with a lot of ‘ok’ to ‘good’ leftovers, and not all are worth smoking on their own. As I try to be thrifty, I’ll often blend 4-6 with complimentary flavors together to make something new. Mixology for tobacco if you will.

2 Recent concoctions that came out really well:

Old Fashioned Tobacco

Just the right aromatics, not too sweet; easy to be a daily go to.

Bourbon blend:

  • Borkum Riff Bourbon
  • Stanwell Vanilla
  • Moontrance (fruit bourbon vanilla)
  • Cherry (mild blend)
  • Molto Dolche (as simple syrup)

Accompanying in jar:

  • Bourbon stave 1×1 cube
  • Orange rind 2×2, for flavor and natural humidor for tobacco

The next one was a combination of leftovers from the sweet side.

Sweet Tooth

  • Crème brûlée
  • CAO Vanilla
  • Autumn Eveni;ng
  • Wicked

Tastes of autumn apples, caramel, brown sugar, vanilla. Caramel Apple Pie a la mode. Dessert in a pipe.

That’s all for now. I’m off to the porch to enjoy a pipe. See you soon.

Play it Again Sam – A Recap of MUS 2022

I had a wonderful time participating in the Magnet User Summit, both in person and virtually. After 2 years of participating virtually, it was my first time attending the Summit in person. It was great to meet for the first time in person, not just many of my coworkers, but many of the regulars in my Twitter stream as well. What a gathering of brilliant, yet equally humble, investigators.

During the Summit I participated on a panel about Bringing your Forensics Lab to the Cloud. I also had fun co-presenting on two talks, Walkthrough of a BEC (Business Email Compromise) and. Walkthrough of a Ransomware Investigation, where we looked at the examinations from a Law Enforcement and from a corporate perspective.

There was the surreal moment of realizing that the boss doesn’t just rock, he ROCKS!

This year there was an in person and a virtual CTF with separate evidence and challenges. For the in-person CTF we examined a Linux laptop and an iPhone. Also, the long anticipated Dark Mode is a treat for the retinas.

For the virtual CTF the evidence sources were a Windows image and an Android mobile device, and a Google TakeOut. I surprised myself with how well I did on the Android and that hasn’t been my area of expertise.

During the virtual summit I enjoyed sharing my presentation, Free Tools for DFIR Triage Collections. Special thanks to everyone who engaged with me during and after the presentations, and from all different time zones. Your support was very much appreciated. If you missed it during the Summit or want to watch it again, you can head over to the Presentations page.

You can also check out all the other recorded presentations from the 2022 Magnet User Summit via the link below.