Using DFIR Techniques To Recover From Infrastructure Outages, (Fri, May 26th)

Recently, I was involved in a network outage caused by a defective pfSense firewall appliance. Due to storage issues (with the onboard flash), the firewall did not boot anymore. This can be quickly solved from a hardware point of view because this firewall model has a slot to install an M2-compatible flash device and boot from it. But, there was a problem with the configuration. The last backup they had was pretty old, and they made a lot of changes. No debate about the fact that a robust backup process should have been implemented. Let’s focus on the challenge of recovering the last configuration from the firewall. Challenge accepted!

Article Link: https://isc.sans.edu/diary/rss/29886