Over the years, we’ve given forensic training to thousands of students spanning all levels of expertise, from beginners just getting their start in forensics, to seasoned professionals looking to shar...

Shortlink:  startme.stark4n6.com QR Code: If people have suggestions for additions please feel free to shoot me a message on the app formerl...

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

I did a few talks covering “Analysis without Paralysis” over the past year, and every time I finished I immediately thought I need to get this documented. Well, today I’ve taken t…

I promise I'm OK 🙂 Earlier this year I wrote a post about Observations.db, which is a component of Apple's FindMy functionality. It was the second part of a post I had written in 2024 about rogue Bluetooth trackers and FindMy compatible devices on iOS devices. In short, FindMy data can offer examiners additional sources of location information along with information about other Apple devices that may be on a given account.

Shop t-shirts, phone cases, hoodies, art prints and mugs created by independent artists from around the globe.

What started as an idea a month or two ago, has become a reality. Introducing The Evidence Locker , a compiled repository of publicly avai...

Master the art of threat hunting and incident response with Velociraptor, a rapidly emerging powerhouse in cybersecurity. This hands-on course, led by industry experts Eric Capuano and Whitney Champi...

Drastic time reduction (especially SQLite writing) Better report foldering Minor bug fixes and tweaks Full Changelog: v1.0...v1.1

  What started as an idea a month or two ago, has become a reality. Introducing The Evidence Locker , a compiled repository of publicly avai...

What started as an idea a month or two ago, has become a reality. Introducing The Evidence Locker , a compiled repository of publicly avai...

What's new in OneDriveExplorer OnedDriveExplorer v2025.11.07 now includes a dedicated parser for Microsoft.FilesOnDemand....

CyberPipe-Timeliner was developed in response to a colleague's query about integrating Magnet Response collections with ForensicTimeliner. This tool automates the workflow, transforming collection data into a unified forensic timeline. With features like date filtering and flexible input options, it streamlines the timeline generation process, making it efficient and user-friendly. #DFIR

Going forward I will be updating the title of the blogs to reflect just the month and not the specific day (it becomes hard to post on the 1...

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

I was asked to join my good friends Debbie, Jessica and Kim over at Hexordia for their Truth in Data podcast to talk one of my favorite to...

While I unfortunately couldn't attend the conference I did see that the BSides NYC CTF board was available still ( check here ). Christopher...

A common theme in digital forensics is putting the target behind the keyboard. One way to help this is around the use of passcodes and especially the use of biometrics. How can we determine though wha...