I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange

Orlando, FL
Joined November 2008
Filter
Exclude
Time range
-
Near
Replying to @kriggins
@kriggins Did you remember to clean out the ear wax?
Crichton's "Pirate Latitudes" reads like a bad Sabatini rip-off. Seriously, just download "Captain Blood" from Project Gutenberg instead...
Replying to @davehull
@davehull So sorry to hear. I know how frustrating that is!
@PhilHagen @NevieHagen TRex could count to 15 in binary... More if it used its toes and tail! :-)
All this Mac forensics work is definitely improving my XML parsing skills...
Heading home for the weekend. Rumor has it that my wife will be there as well. Awesome!
Replying to @lennyzeltser
@lennyzeltser Wording doesn't help. Users don't read. They just look for the button that let's them accomplish their task.
Lesson (re-)learned: in many programming languages, "=" and "==" are very different. This difference is important...
2
"So drive yourself insane tonight; it's not that far away and I just filled up your tank earlier today..." - Alkaline Trio, "Mercy Me"
Any #DFIR folks done much work with BeejiveIM artifacts? Particularly their buddies plist file? Drop me a line if so...
RT @TheChrisCurran: HAHA...the 4 1/2 things missing from the iPad2... http://j.mp/ghZtHJ [And this is why I'm waiting for iPad 3]
1
Replying to @diami03
@diami03 Behind the kitty?
Replying to @grecs
@grecs Have you tried applying for the "work study" program?
Fixed my eyeglasses with my Leatherman tool. Feeling like a Sys Admin again...
Replying to @dckovar
@dckovar Repeat after me: "Corporations are not people. Money is not speech."
@4n6woman Let's go OAK-Land! (clap clap clapclapclap)
RT @gleeda: Amount of profanity in git commit messages per programming language http://bit.ly/dLw501<- hahahaa
1
1
Replying to @iamevltwin
@iamevltwin You may get some previews of the material via the SANS Forensics Blog over the next few weeks... Look forward to meeting you!
Replying to @MorrMac
@MorrMac I should point out that "bplist at byte offset 16 from start of block" makes it very easy to spot deleted copies in unalloc space