Re: Forensics on Terminal Server Client
TheGesus <[email protected]> Tue, 13 Nov 2007 11:59:39 -0500
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
If you dump one of the *.bmc files it's pretty obvious from the number of repeating byte patterns that it's not compressed (or encrypted). And if you compress one of the files, it will compress nicely, which is a fairly good indicator that they're not compressed to begin with. On Nov 10, 2007 3:28 PM, Mike Theriault <[email protected]> wrote: > It's probably compressed so in that case you probably wont find any header information. > > Mike Theriault > Security Enginer