• Thursday, 11 May 2017 11:00AM EDT (11 May 2017 15:00 UTC)
  • Speaker: Phill Moore

Google's market share in the search engine space ensures that it is usually the first port of call when someone needs information. Google, being the data-driven company that it is, likes to record data about the user's activity, some of which is hidden in plain sight in the URL string.This treasure trove of cryptic data extends well beyond the humble search term. As Google Search artifacts are found on just about every examination, this presentation will take a look at what information we can decode from the Google URLs found in Internet History and Cache to assist in determining a user's actions, and, where possible, adding reliability to the times in our timelines.

To learn more on this topic, attend the 10th annual SANS Digital Forensics & Incident Response (DFIR) Summit & Training. This training event brings together the most influential group of experts, the highest quality training, and the greatest industry networking opportunities in one place. Over the course of this eight-day training event, you'll enjoy:

  • Highly technical digital forensics and incident response presentations from the industry's top practitioners during the two-day Summit
  • Nine SANS DFIR courses to choose from to advance your training, build your arsenal of defenses, and learn how to better protect your organization
  • The opportunity to network with fellow attendees at receptions and community-building events
  • A DFIR NetWars tournament to sharpen your skills and solve incident-related challenges