Follow the evidence. Independent research on digital forensics, incident response, and the traces an attack leaves behind.https://0x7ouda.github.io/enhttps://0x7ouda.github.io/notes/chapter-5-the-art-of-memory/https://0x7ouda.github.io/notes/chapter-5-the-art-of-memory/Brief notes summarizing Chapter 5 of (AMF), focusing on Windows objects, kernel pool allocations, pool tags, pool-scanning techniques, Big Page Pool analysis, and alternative methods for locating kernel objects.Fri, 09 Oct 2026 00:00:00 GMTThe art of memory forensicshttps://0x7ouda.github.io/notes/chapter-4-the-art-of-memory/https://0x7ouda.github.io/notes/chapter-4-the-art-of-memory/Brief notes summarizing Chapter 4 of The Art of Memory Forensics, focusing on memory acquisition methods, dump formats, virtual machine memory, memory conversion, and volatile evidence stored on disk.Mon, 05 Oct 2026 00:00:00 GMTThe art of memory forensicshttps://0x7ouda.github.io/notes/chapter-2-the-art-of-memory/https://0x7ouda.github.io/notes/chapter-2-the-art-of-memory/Brief notes summarizing Chapter 2 of The Art of Memory Forensics, focusing on different data structures, how they are organized and stored in memory, and how they are interpreted during memory analysis.Tue, 29 Sep 2026 00:00:00 GMTThe art of memory forensicshttps://0x7ouda.github.io/notes/chapter-1-the-art-of-memory/https://0x7ouda.github.io/notes/chapter-1-the-art-of-memory/Brief notes summarizing Chapter 1 of The Art of Memory Forensics, with a focus on system overview and core operating system concepts.Mon, 21 Sep 2026 00:00:00 GMTThe art of memory forensicshttps://0x7ouda.github.io/writeups/glyph-dfir-investigation/https://0x7ouda.github.io/writeups/glyph-dfir-investigation/A DFIR walkthrough of the Glyph challenge, tracing a Unicode homograph phishing chain through browser artifacts, PowerShell, NTFS, SRUM, malware execution, C2 activity, and persistence.Mon, 14 Sep 2026 00:00:00 GMTCTFCAT Reloaded CTF 26https://0x7ouda.github.io/research/curve-finance-dns-hijacking/https://0x7ouda.github.io/research/curve-finance-dns-hijacking/A blockchain security investigation into the 2022 Curve Finance DNS hijacking attack, tracing the malicious approval flow and calculating the stolen funds.Wed, 09 Sep 2026 00:00:00 GMTBlockchainhttps://0x7ouda.github.io/research/reverse-phone-seo-cloaking-optimized/https://0x7ouda.github.io/research/reverse-phone-seo-cloaking-optimized/An OSINT-driven investigation into SEO cloaking infrastructure, deterministic phone-number generation, redirects, and ad-based monetization.Mon, 17 Aug 2026 00:00:00 GMTOSINThttps://0x7ouda.github.io/notes/file-system-analysis-ecdfp/https://0x7ouda.github.io/notes/file-system-analysis-ecdfp/A concise guide to file system forensics, covering FAT and NTFS structures, deleted file recovery, file carving, and practical tools like SleuthKit, Autopsy, and PhotoRec.Wed, 18 Feb 2026 00:00:00 GMTECDFP_Noteshttps://0x7ouda.github.io/tools/malmon/https://0x7ouda.github.io/tools/malmon/A Windows-focused dynamic malware analysis and triage tool that monitors process trees, command lines, network connections, registry activity, and file I/O, then exports structured HTML and JSON reports.Tue, 17 Feb 2026 00:00:00 GMTMalware Analysishttps://0x7ouda.github.io/notes/ecdfp_notes/https://0x7ouda.github.io/notes/ecdfp_notes/ECDFP notes covering disk forensics fundamentals, CHS/LBA addressing, MBR and GPT structures, boot records, and partition analysis with practical hex examples.Wed, 21 Jan 2026 00:00:00 GMTECDFP_Noteshttps://0x7ouda.github.io/writeups/aotr-4-a-drone-in-the-snow/https://0x7ouda.github.io/writeups/aotr-4-a-drone-in-the-snow/A recovered disk blew the case open. The files inside weren't theory, they were a checklist. Hours later, an unmarked matte-black drone was found half-buried in snow in Budapest,Sat, 10 Jan 2026 00:00:00 GMTHackTheBoxDrone_Forensicshttps://0x7ouda.github.io/writeups/aotr_3_the_abandoned_farmhouse/https://0x7ouda.github.io/writeups/aotr_3_the_abandoned_farmhouse/ The coordinates led police and investigator into winter, to a place far enough from everything that no one would notice if something went wrong.Sat, 03 Jan 2026 00:00:00 GMTHackTheBoxencrypted_diskhttps://0x7ouda.github.io/notes/splunk-destection_rule/https://0x7ouda.github.io/notes/splunk-destection_rule/A practical SOC home lab guide to building Splunk detection rules and alerts for XSS, command injection, and SQL injection attacks.Tue, 30 Dec 2025 00:00:00 GMTSplunkhttps://0x7ouda.github.io/writeups/hackthebox_sherlock_holmes_the_tunnel_without_walls/https://0x7ouda.github.io/writeups/hackthebox_sherlock_holmes_the_tunnel_without_walls/A memory dump from a connected Linux machine reveals covert network connections, fake services, and unusual redirects. Holmes investigates further to uncover how the attacker is manipulating the entire network!Sun, 28 Dec 2025 20:00:00 GMTHackTheBoxMemory_Forensics