Previous: Windows 11 | Cipher | iOS 16 iPhone For part three we get yet another nontypical piece of evidence. Here we have a VMDK of a Windows Server environment. While the artifacts are more or less the same as Windows 10, we might find extra things of interest.Tools used:Autopsy v4.20AXIOM v6.11DB... [Read More]

Previous: Windows 11 | Windows Server | iOS 16 iPhoneI always enjoy working on the cipher portions of the Magnet CTFs. They don't require any forensic tools and can be done with online tools. I've even seen some people solve them just by using their mobile phone in past years.Tools used:CyberChefDcode.frTime... [Read More]

Previous: Cipher | Windows Server | iOS 16 iPhoneAs conference season ramps up we have more CTF competitions to play! Jessica Hyde and the students from the Champlain DFA group created another one for the Magnet Virtual Summit (and the in-person summit coming up in April 2023). The fun part of... [Read More]

Shortlink: startme.stark4n6.comIf people have suggestions for additions please feel free to shoot me a message on Twitter (@KevinPagano3) or Mastodon.I rebranded the Network Tools to now include Cloud tools. With cloud becoming more and more relevant I thought it was time to try and add some scripts and other things I've found... [Read More]

Shortlink: startme.stark4n6.comIf people have suggestions for additions please feel free to shoot me a message on Twitter (@KevinPagano3) or Mastodon.DFIR YouTube FeedCactusConHexordiaForensic ToolsHayabusa - sigma-based threat hunting and fast forensics timeline generator for Windows event logsGetting Started in DFIRFREE DFIR First Responder Bootcamp - Pop Pop RetLessons Learned from Cybersecurity Mentoring -... [Read More]