Magnet User Summit CTF: Misc
We are continuing our write-up. The second part will walk you through the solution of the second set of CTF problems –…
Magnet User Summit CTF: Anti-Forensics
Yesterday Troy Schnack and Kevin Pagano suggested on Twitter that it would be good to write how I solved Magnet User Su…
Smartphone Acquisition: Adapt, Adjust and Get Smarter!
Heather Mahalik has posted about a list of recommendations on iOS and Android-based smartphones forensic acquisition. If you…
Where Did It Come From: Forensic Analysis of Zone.Identifier
As you may know, David Cowen runs Sunday Funday Challenges, and one of the most recent was Zone.Identifier challenge. I have…
afro (APFS file recovery)
afro can parse APFS images. It not only extracts the latest data but also older versions of the files. Learn more about the …
Epochalypse: Utility to Convert Epoch Timestamps
Epochalypse utility by Pasquale Stirparo has been updated. Now it supports APFS timestamps. You can download this Pytho…
Forensic Analytics for Acquiring and Preserving Reliable Data from Cloud Hypervisors
Cloud computing is this decade’s major computing advancement. Many business enterprise remain reluctant to move their …
Using the Office 365 Activities API to Investigate Business Email Compromises
Business email compromises (BECs) are a big problem across a multitude of industries. Just last week, the FBI participated i…
RDP Event Log Forensics
As a continuation of the “Introduction to Windows Forensics” series, this episode takes a comprehensive look at …
Dear Blue Team: Proactive Steps to Supercharge your IR
In an age where data breaches and malware infections are quickly becoming the norm, we must prepare for Digital Forensics an…
