Digital forensics

Since we live in a digital world, it becomes utmost important for digital environment to be secure so that we can operate safely and reliably. So often we ha

In Part 1 of this series, we looked at PowerShell remoting artifacts under various Event IDs and ways to gather more information from those events and relate

In the previous article, we discussed some important GUI objects like session, window stations, and desktops. As we saw earlier memory forensics of GUI objec

In this article series, we will take a look at the Windows GUI forensics which is often not discussed. We will take a look at the various structures and how

Introduction As defined in the RFC 2350 (Expectations for Computer Security Incident Response), the security incident is any adverse event which compromi

From the newly-published Mastering Mobile Forensics by Soufiane Tahiri.  Smartphone forensic is relatively new and quickly emerging field of interest with

We discussed NTFS timestamps in Part 1 of this series. In this article, we will look at some of the artifacts which can point out  a program execution on a W

In this article, we will learn about critical Windows artifacts, what they mean, where they are located in the system, what can be inferred from them and how

In this article, we will take a look at important Windows Event IDs, what we normally see in logs and how different EventID can be used to construct the late

This mini-course started with forensic memory basics, in this mini-course, we have explained how you can and what you can find artifacts from memory. As Memo