@ArsenalRecon profile picture
Arsenal Recon @ArsenalRecon

Developers of digital forensics weapons which include Arsenal Image Mounter, Hibernation Recon, LevelDB Recon, HBIN Recon, & Registry Recon. Arm Yourself! #DFIR

Joined August 2012
  • Tweets 1,343
  • Following 1,247
  • Followers 3,458
683 Photos and videos
Pinned Tweet
Arsenal Recon@ArsenalRecon
13 Sep 2024
Arm yourself with our tools & eliminate blind spots in digital forensics! ArsenalRecon.com #DFIR
2:20
2
6
2,380
The "TechHive Scenario" is a Windows on Arm disk image we made available to the public via NIST CFReDS (cfreds.nist.gov/all/MarkSpen…) about a month ago. Have you used it for #DFIR training or R&D? We just used it for LevelDB Recon R&D, here's a couple internal build screenshots.
3
104
Have you thought about how Hibernation Recon could be used to gain new insight into your highest-stakes cold cases? We released a new version (v1.2.3.96) yesterday with significant updates. ArsenalRecon.com #DFIR

Arsenal Recon@ArsenalRecon
May 28
Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR
1
3
661
Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR
6
17
2,812
Here's the new Hibernation Recon running on Windows on Arm (WoA) & processing WoA, Windows x64, & Windows x86 hibernation (hiberfil.sys) files! We continue to put extremely powerful & unique functionality in the hands of #DFIR practitioners. Arm yourself! ArsenalRecon.com
2
5
573
Here's the new Hibernation Recon (v1.2.3.96) in action! What do you notice about Windows architecture support? Did you know that Hibernation Recon also supports hibernation from Windows XP through the latest build of 11? ArsenalRecon.com #DFIR
2
2
468
We just released Hibernation Recon v1.2.3.96 with some awesome updates - Windows 24H2 & 25H2 support, new decompression algorithms, now runs on Windows on Arm & Linux, etc. How do you analyze Windows hibernation? ArsenalRecon.com #DFIR
4
5
390
Back in the office after sponsoring & exhibiting at the @IACIS 2026 Orlando Training Conference. It was great meeting so many digital forensics practitioners in person! We brought a Neo Geo for students to play towards the end of training... next year we'll have prizes! #DFIR
1
5
375
We’re ready for another day at the @IACIS Orlando Training Conference, making more #DFIR practitioners aware of the powerful & unique things our tools can do for them. What’s that under our TV? ArsenalRecon.com
1
7
277
Traveling to the @IACIS Orlando Training Conference! Come see us Tue-Th to talk about maximum exploitation of electronic evidence that is not currently possible with other tools & published techniques. Windows swap, hibernation, & more - let's go! ArsenalRecon.com #DFIR
1
3
378
Emina got to the @MassAGO's National Cyber Crime Conference early yesterday to get our classroom setup. We had a mixture of motivated local, state, & federal law enforcement in our workshop "Disks are Gamblers and Virtualization is Vegas." ArsenalRecon.com #DFIR #NCCC2026
1
1
8
406
Getting class materials ready for our "Disks are Gamblers and Virtualization is Vegas" workshop tomorrow at the @MassAGO's National Cyber Crime Conference! Notice anything interesting about this laptop? ArsenalRecon.com #DFIR #NCCC2026
1
1
5
540
Congratulations to Nicholas Smith & Oleksandr Lysyi for completing the Arsenal Image Mounter online training & certification! ArsenalRecon.com #DFIR
1
6
348
Are you attending the @MassAGO's National Cyber Crime Conference next week? This will be a great opportunity to attend one of our in-person only workshops - Disks are Gamblers and Virtualization is Vegas. #DFIR #NCCC2026
1
1
357
Here’s something you don’t see every day in #DFIR - launching a virtual machine from a Linux laptop (safely booted with WinFE) connected to Arsenal Image Mounter across a network via AIM Remote Agent! ArsenalRecon.com
1:51
2
6
1,712
Another video of more Linux functionality from the latest Arsenal Image Mounter... this time, creating a forensic image from a physically-attached disk with the AIM Linux CLI. (& yes - slow laptop, slow disk, slow interface in this demonstration. 😂) ArsenalRecon.com #DFIR
2:00
1
3
521
Have you seen Arsenal Image Mounter's latest Linux functionality? Check out the AIM Linux Pro CLI creating a Recon Report from a disk image containing a BitLocker-protected volume and then unlocking & browsing that volume. ArsenalRecon.com #DFIR
1:35
3
10
1,372
Now that our "TechHive Scenario" Windows on Arm disk image has been used in a @ChamplainEdu CTF, we think it's time to make it public. Any thoughts on where we should host it? The disk image & associated files are approximately 90gb in size. ArsenalRecon.com #DFIR
1
1
2
557
Are you an @IACIS member attending the Orlando Training Conference? We'll be there for the first time as a company rather than as students. Come see us May 5-7 to talk about maximum exploitation of electronic evidence & try something fun at our table. #DFIR
2
6
666
Have you armed yourself with the latest Arsenal Image Mounter yet? See the new passkey usage information in action! As a bonus, you'll also see AIM running on Windows on Arm. ArsenalRecon.com #DFIR
1:38
1
5
720
Let's improve the signal-to-noise ratio in #DFIR social media! Check out Arsenal Image Mounter v3.12.344 on a Snapdragon X Elite Arm laptop launching a disk image from a Snapdragon 8cx Gen 2 laptop into a virtual machine & running @Belkasoft Triage! ArsenalRecon.com
2
5
593
Load more