Well then I must say CIRCLE CIRCLE DOT DOT now I've got my cooties shot!

Sil I continue to be impressed by your unique views and insight.    I think you and I are in pretty much the same boat; I’ve got 2 kids 2 and 3, work, school, heavy metal, video games etc... Where does one find the time to compose such well thought out responses? I caught your response to the SCADA article and must admit I LOLd a bit.  +1 for the KFC reference!

I overlooked that handy little sentance, without proper training your entering a hazy area regarding gathering forensic data for use in court cases. From your initial post you sound relatively new to the field if thats the case I would be more concerned with getting a great lab set up to train yourself instead of building a forensic lab for evidence collection.  If I'm wrong I apologize and mean no offense its just that forensic examination for court cases can be extremely tricky.

Consider me signed up thanks for the link!

Excellent the contest does allow you to sign up solo, I was thinking that if we could get 4 EHer's we could make a pretty solid team.  If we don't get 4 im thinking about taking this on solo.

My company recognized the criticalality of APT's last year so we had Mandiant come by for some APT training and we picked up a Mir controller box, best security investment in years!  We can easily identify any suspicious activity on client machines looking for signs of APT's.  I would highly recommend anyone interested in APT's reach out to mandiant those guys practically wrote the book on identification and remediation of APT's they also do some kick ass unknown binary analysis and offer up free versions of most of their tools.

I'd say the best forensic investigators tend to look at both sides of the coin.  I myself have been focused on both ethical hacking and forensic investigation for awhile after I get my associates degree in forensics I'm going to start with the CHFI then get work to send me to all the sans courses they can.

I do love me some BT, ive been running it in a vm on my macbook pro for awhile I'm finally toying around with the idea of dual booting it just to get cuda support but I might hold off till 5 comes out.

If it was facebook based you could easily access it through the developers api.  If its a .pcap file that requires analysis then gnix got the hook up!

Helix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there.  I'd also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform.  Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well.  I currently use all 4 plus a random assortment of scripts and tools I've picked up along the way.  Sans ftk is free after registering here:  http://computer-forensics.sans.org/

Has anyone though of signing up for the DC3 challenge?  Details are located here: http://www.dc3.mil/challenge/2011/  I would love to get a team together if anyone is interested please PM me or respond to this message.

I'm in the same boat tried cracking the PDF analyzed the structure looking for clues and tried manipulating the qscan codes with no success I'm sure its something Ive overlooked but I'm at a loss but I refuse to give up!

I've been following this site for awhile now, finally had to register to say I love this challenge, excellent job especially the starting point.... Like several others I've been stuck on the PDF but regardless very cool promotional idea!