Latest post
Your Browser Is Keeping Years of Your WhatsApp
A forensic deep-dive into WhatsApp Web: where its data lives on disk, what sits there in plaintext, the one thing that is encrypted, and how it was reversed.
Blog
Field notes on digital forensics and incident response.
Write-ups on forensic artifacts, investigation workflow and the open-source tools behind them.
More posts
6 posts in total
-
Windows Prefetch: what it proves, and what it does not
Prefetch at the byte level: the SCCA header, MAM compression, the path hash, run times and volumes, with working Python and the limits to state in a report.
-
Zone.Identifier: what the Mark of the Web records about a download
How Windows marks downloads in an NTFS alternate data stream: where it lives in the MFT, the zone and URL keys, hunting it at scale, and how it disappears.
-
Reading Windows logon types in event 4624
Logon types, the 4624 fields that change the reading, 4625 failure codes, following a Logon ID through a session, and queries for PowerShell, wevtutil and KQL.
-
Detailed Guide to Detecting and Analyzing a Kerberoasting Attack in Active Directory Using Splunk
Detecting and investigating a Kerberoasting attack on Active Directory in Splunk, from the attack steps to the event 4769 fields that give it away.
-
Comprehensive Guide to Malware Analysis: Investigating Malicious RTF Files Using REMnux
A step-by-step analysis of a malicious RTF document on REMnux with rtfdump, rtfobj and scdbg, from embedded objects to the shellcode they carry.