---
id: 1963
title: "Using osquery for remote forensics"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics/"
published_at: "2019-05-31T15:59:48Z"
tags: ["incident-response", "dfir", "digital-forensics", "osquery", "ntfs", "timestomping"]
phying_url: "https://phying.com/item/1963"
lang: en
---

# Using osquery for remote forensics

## Summary

Trail of Bits and Crypsis demonstrate osquery as a remote forensics tool: the NTFS extension surfaces $SI vs $FN timestamp mismatches revealing timestomping and directory entries of deleted files.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2019-05-31T15:59:48Z
- **Original:** https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics/
- **Phying News:** https://phying.com/item/1963