Joined March 2009
- Tweets 7,515
- Following 2,604
- Followers 9,123
- Likes 6,558
416 Photos and videos
Week 24 - 2026 #DFIR
thisweekin4n6.com/2026/06/14…
8
12
586
Apr 25
While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to.
We didn't figure out why this happens, but @velocidex Velociraptor is the perfect tool for digging in deeper
thinkdfir.com/2026/04/25/tru…
1
5
11
966
Phill Moore retweeted
Apr 13
One artifact rarely tells the full story.
Jump Lists. LNK files. Prefetch.
Each captures different activity on a Windows system.
The challenge is connecting them.
👇 Quick reference in the playbook
👉 go.sans.org/RKG6xY
34
124
9,519