Brass Swordfish·1d agoBefore you trust an offline AI with your evidence, measure itMost organisations run a sensitive network that cloud AI can’t touch. Here’s how I would test whether a local model is actually good enough…
Krisna Sirait·3d agoShe Said She Was Hacked. The Evidence Said 1:28 AM. Forensic Case M57-JeanA salary spreadsheet ends up in a competitor’s comments. The CFO says someone broke into her laptop. I got the disk image to find out what…
Krisna Sirait·6d agoI Carved 6 Generations of a Canon SD Card (nps-2009-canon2 [digitalcorpora]) .Six forensic images, dozens of deleted photos, and one important lesson about why file carving doesn’t always work.
wh0arey0u·Nov 2由Azure Sentinel＋Logic App＋AI砌一套自動化 SOC Playbook — 第二篇: phishing email response playbook上一篇我哋講完成個架構，由 Sentinel、Logic App、Defender API 到 Managed Identity 嘅關係，同埋 Standard vs Consumption tier 點揀。今篇我哋落手砌 — 由零開始寫一個真係 work 嘅 phishing…
Redd Francisco·Nov 2Ghost Persistence: Uncovering WMI Permanent Event SubscriptionsWhen Run keys, Scheduled Tasks, and Startup folders come back clean, check WMI permanent event subscriptions (root\subscription and…
Devansh Jaiswal·Nov 2DFIR Labs: “2-Layer Security” Writeup — Peeling Back a PowerShell Encryptor and a GPG WrapperSuggested Medium subtitle: How a hacker’s own shell history, an obfuscated PowerShell one-liner, and a forgotten GPG keyring gave up a…
Pongsathorn Parivutthipong·Nov 2Ivanti Connect Secure (CVE-2026-104935 / CVE-2026-111357 / CVE-2026-118527) — Lab Verification & IR…Author: Pongsathorn Parivutthipong · Date: 2026-11-01 (UTC+7) · Scope: defensive inventory / hunt / recovery verification on an isolated…
![I Carved 6 Generations of a Canon SD Card (nps-2009-canon2 [digitalcorpora]) .](https://miro.medium.com/v2/resize:fill:160:106/1*djpmACkxWLW02VAZEK6gfw.jpeg)
![I Carved 6 Generations of a Canon SD Card (nps-2009-canon2 [digitalcorpora]) .](https://miro.medium.com/v2/resize:fill:320:214/1*djpmACkxWLW02VAZEK6gfw.jpeg)
