Acquiring Memory in Digital Forensics: Vendor Tools vs. Custom Solutions

- Posted in Other by
Background: Before analyzing volatility memory , there is a crucial preparatory stage: defining the tool scope for memory acquisition. In this phase, there are two primary approaches—either [...] Read more

Challenges of Digital Drives: File Recovery in Practice Without Expensive Tools [ Final Part ]

- Posted in Incident Response by
Background: In the previous article, we discussed how files are stored inside drives and highlighted the essential metrics to consider after acquiring the storage footprint. Now, we will dive deeper [...] Read more

Challenges of Digital Drives: Footprint Integrity and Binary View During Incident Response Log Collection

- Posted in Incident Response by
Background: In one of our previous articles, I've introduced the process of preparing a USB drive/tool for forensic analysis. Now, it is time to delve one level deeper and explore the key points that [...] Read more

Native Linux Incident Response: Evidence Collection Without Third-Party Tools

- Posted in Incident Response by
Background: That being said, the incident response subprocess, from the perspective of budgeting and complexity, is not necessarily easy. However, today's tooling and built-in tools provide us with [...] Read more

The Evolution of Malware Infection Chains: Analysis of Multiplication and Complexity Over the Years

- Posted in Other by
Background: In a perfect scenario, before malware is executed on a victim's machine, it must go through several stages and specialists. First, a core malware function writer develops its primary [...] Read more