Small discoveries, useful commands, and practical observations from the forensic notebook.
Brief notes summarizing Chapter 5 of (AMF), focusing on Windows objects, kernel pool allocations, pool tags, pool-scanning techniques, Big Page Pool analysis, and alternative methods for locating kernel objects.
Brief notes summarizing Chapter 4 of The Art of Memory Forensics, focusing on memory acquisition methods, dump formats, virtual machine memory, memory conversion, and volatile evidence stored on disk.
Brief notes summarizing Chapter 2 of The Art of Memory Forensics, focusing on different data structures, how they are organized and stored in memory, and how they are interpreted during memory analysis.
Brief notes summarizing Chapter 1 of The Art of Memory Forensics, with a focus on system overview and core operating system concepts.
A concise guide to file system forensics, covering FAT and NTFS structures, deleted file recovery, file carving, and practical tools like SleuthKit, Autopsy, and PhotoRec.
ECDFP notes covering disk forensics fundamentals, CHS/LBA addressing, MBR and GPT structures, boot records, and partition analysis with practical hex examples.
A practical SOC home lab guide to building Splunk detection rules and alerts for XSS, command injection, and SQL injection attacks.
