Full detailed writeup for ReAL-File-System which is centered around ReFS Log Analysis.

tl;dr

• Disk Forensics
• Resilient File System
• Log Analysis

tl;dr

• Registry Hives analysis
• Analyse Chrome browser artifacts
• Analyse Slack artifacts
• Analyse AnyDesk artifacts
• Analyse artifacts for evidence of execution
• Analyse clipboard artifacts

Full solution of Batman Investigation II - Gotham Underground Corruption from bi0sctf 2024

tl;dr

• Challenge 1 of Batman Investigation series
• Memory Forensics - WinDBG Dump Debugging - Malware Analysis - Incident Response - Threat Hunting

Full solution of Batman Investigation II - Gotham Underground Corruption from bi0sctf 2024

tl;dr

• Challenge 2 of Batman Investigation series
• Memory Forensics - WinDBG Dump Debugging - Malware Analysis - Blockchain Forensics - Password Retrieval - MAC Artefact Analysis

tl;dr

• Create a Linux profile for Ubuntu 18.04 (5.4.0-42-generic) in Volatility
• Use linux_bash plugin to get link to the repo and linux_find_file plugin to recover the filepath
• Decode the keyboard stream data to retrieve the flag

tl;dr

• Extract creation timestamp of a note from Google Keep Notes.
• Finding location, date & time from Slack Messages.
• Extract no. of tasks completed and created from Google Tasks.
• Finding secret code from Google Docs cache.
• Extract first opened timestamp of a Game.

tl;dr

• Extract User ID and Workspace ID of the Slack workspace participating.
• Extract the first & last 3 characters of text from the Anydesk Remote connected PC’s thumbnail wallpaper.
• Extract the type of filesystem of the USBs connected to the system.
• Extracting active duration of Voice Modulator application used by parsing Windows Activity timeline.

tl;dr

• Finding default browser and the top visited website.
• Extract timestamp, ID, Hostname of the TeamViewer FileTransfer session.

tl;dr

• Finding Chat application
• Extract unread message count from NTUSER.dat.
• Extract the last executed timestamp of the chat application.
• Extract the Version of the chat application.

tl;dr

• Analysing Google keep mobile artifacts.