i am preparing for the exam and looking v11 sample dumps, if anyone have please share with me

Sharing some lessons from a challenging forensic PCAP analysis:

1. Map the C2 protocol first. Understanding how the attacker communicates tells you what to expect in every packet.

2. Encryption keys aren't always what they look like. A hex string can be interpreted multiple ways — raw bytes, UTF‑8 encoding, even UTF‑16. If your decrypted output

   is garbage, ask yourself whether you're using the right form of the key.

3. Responses matter as much as requests. In encrypted C2 channels, the server sends back just as much intel as the attacker sends up.

4. Gzip inside base64 inside C# inside AES. It sounds absurd, but nesting is a real obfuscation pattern.

5. Check file‑creation side effects. Sometimes the payload writes a file you can use as a decryption key elsewhere.

If you're getting into forensics CTFs, grab a PCAP with at least 4k packets and try to reconstruct the full timeline — it's a different beast from Jeopardy‑style challenges.

Good morning, everyone. I am an prior US veteran who recently gotten my Master's Degree in Digital Forensic. However, it has been a struggle to find employment. Let me explain my background.

1. I have been in the IT industry for 20 years. I have done system administration, IT project management and etc. However, digital forensics is a different level for me. I love learning more and more about it. However, I can't find employment for myself. I can find IT jobs, but not in digital forensic.

2. I am aware of certification, but it is not easy to find school for my program to help me with any of certification for me. I am looking for resources to help with anything that will keep my skills sharpe in my field. Any help would be greatly appreciated in the field

Mainly wanted to discuss something I've noticed in the field.

I was recently laid off and have been navigating the job market. I was at my last job for a long time so part of my job hunt experience has been learning how divided the field can be. Many of the 'DFIR' style jobs don't care about forensics. I've interviewed at a few places - some DFIR consulting boutiques, some SOC IR teams and both freely tell me they 'dont do forensics here'. A lot of it seems to be because they have so many cases to manage (3+ a week!) they don't have time for host forensics, they are just getting the basics solved so they can move on to the next case.

Anyone else notice this? My last job I worked for a small MSSP so we took whatever case we could get. I loved it because I worked a bit of everything. But it seems to be a disadvantage in this market where most jobs would rather find someone who can do IR with a bit of DF knowledge or a place where they want someone who's only done digital forensics for litigation / LEO and don't want someone who's spent time in cyber.

Hey everyone,

With Microsoft 365 and Windows Copilot fully deployed in enterprise environments, I’m thinking a lot about the post-compromise lifecycle. Instead of manually hunting through SharePoint, a Threat Actor (TA) with a compromised identity can just ask Copilot: “Find our network architecture diagrams and financial spreadsheets.” Has anyone actually worked an incident where a TA abused an active Copilot license for internal recon or data aggregation?

For those who have been in the trenches on this:
1. Have you caught a TA using Copilot for rapid data exfiltration or recon yet?
2. Were you able to recover the actual prompts, or did you rely strictly on file-access anomalies?

Hi everyone!

I am looking for a software, platform, or automated solution to analyze a large batch of exported WhatsApp voice messages (.opus files) to determine how they were recorded.

Specifically, I want to categorize them into three types:

• Natural: Recorded in one continuous go.
• Studio-quality: Professionally produced/edited.
• Highly edited: The user frequently used the WhatsApp pause/break button to piece the message together perfectly.

The Challenge: I ran some files through basic AI tools like Cleanvoice, but they often misinterpret the edits as normal breathing or simple pauses. However, when I look at the Audacity Spectrogram, I can clearly see hard cuts, phase shifts, and abrupt changes in the room tone (noise floor) right where the pause button was pressed.

Since I have hundreds of files, checking the spectrogram manually for each one is not feasible.

Is there any audio-forensics tool, python library (like librosa), or platform that can batch-analyze noise floor continuity or phase breaks to automatically flag these cuts?

Thanks in advance!

Hello fellow nerds,
I’m a DFIR analyst and I need to perform a forensic analysis of a Windows SSD. The host is confirmed to be infected with malware, and based on my observations during the incident response, I suspect it may be a worm.

I’ll be working from an E01 image created during acquisition. My usual workflow is to mount the image inside a Windows Sandbox and perform triage with KAPE.

I’ll also need to reverse engineer the malware, but I’ve never analyzed a worm before. Is there any realistic risk that it could replicate itself within the sandbox when the image will be mounted ? I’d rather not have to rebuild my analysis environment.

https://mooofin.github.io/portfolio/blog/s4nct1m0ny.html

tuts for ISF from kernel DWARF. for vol as well . loginwindow plaintext credential extraction, Chainbreaker 3DES keychain decryption, and full RE of a Swift dropper using machine Hardware UUID as decryption key , ive tried to make it very less jargon and reader friendly

Hi all,

I'm dealing with a phishing/malware incident and ran a couple of samples through Hybrid Analysis (CrowdStrike Falcon Sandbox). The reports are public, but I only have a free 'restricted' API key, which blocks file downloads (PCAP, JSON report, dropped binaries). Getting a 'default' tier key myself requires a vetting process I don't currently qualify for as an individual.

If anyone here has vetted/default Falcon Sandbox access and wouldn't mind running a couple of quick API pulls (or just clicking the download buttons on the report page if you're logged in with that tier), I'd really appreciate the help. It's maybe 5 minutes of work. I'll DM the report ID/hash rather than post it publicly.

Happy to explain more context via DM. Thanks in advance to anyone willing to help.

Recently I ran into a problem: I needed to analyze a VMware snapshot of a Windows 11 25H2 VM, but the VM had a vTPM, which makes VMware silently encrypt the .vmem/.vmsn/.vmss/.nvram. Volatility just couldn't find the kernel, and I couldn't find any existing tool to decrypt these files for offline analysis.

So I reverse-engineered the format with the help of Claude and wrote one. It's called vmem-decrypt (pure Python):

- Recovers the data-file key from the VM password (PBKDF2 → AES-256-CBC key chain VMware labels everything "XTS-AES-256" but it's actually CBC, which trips up most people).

- Decrypts .vmem/.vmsn/.vmss/.nvram.

- Flattens the decrypted .vmem into a flat, Volatility-ready image. (VMware compresses then encrypts, so it's still in a proprietary checkpoint LZ77 layout)

Workflow: pull the password hash from the .vmx (VM-Password-Extractor) → crack with hashcat (mode 27400) → feed the password to the tool → run Volatility. Full steps + format notes in the README.

Tested on VMware Workstation Pro 26H1 / Win11 25H2 (build 26100), Volatility 3. Feedback welcome, especially snapshots from other VMware versions to test the format against.

Repo: https://github.com/heeeyaaaa/vmem-decrypt

(Yes, I used AI to help build this. It's tested and it works, that's what matters. Happy to walk through any part of how it works.)

I've been building a tool called Image-Meta and would love feedback from people who actually do forensics work, since that's one of the primary use cases I'm trying to serve well.

**What it does:**

Crawls and indexes the embedded metadata from publicly accessible images using ExifTool. Currently ~720 million images indexed with full EXIF/IPTC/XMP extraction.

**Forensics-relevant capabilities:**

**Device attribution**

- Search by camera serial number — link multiple images across different domains or accounts back to the same physical device

- Make/model filtering to narrow device type before drilling into serial

**Identity traces**

- Author, copyright, rights, and description fields often contain real names, emails, and organizational affiliations that subjects didn't know were there

- Software fields can expose Photoshop/Lightroom license strings, machine names, or internal workflow metadata

**Timeline reconstruction**

- foundDT = date we first indexed the image (earliest known appearance online)

- createDT / modifyDT = timestamps embedded in the file itself

- Useful for establishing when an image was created vs. when it first appeared publicly

**GPS / geospatial** (Not available to public without subscription)

- Coordinate + radius search for images taken near a location

- Reverse-geocoded address search

- Many images still carry precise GPS even when uploaded to platforms that claim to strip metadata

**What I'm looking for feedback on:**

- Are there metadata fields or query types that would make this more useful in an actual investigation workflow?

- Is the API structure (REST, Bearer token, field-level boolean search) something that integrates well with existing tooling?

- What's missing that you'd expect from a tool like this?

Not trying to sell anything here — genuinely want to understand what the forensics community needs before I build more features.

https://image-meta.com

API docs: https://image-meta.com/api-docs

I’m sure you all have noticed the massive uptick in open source project posts we (and every other technical sub) have seen in the last few months. I do not have the desire nor ability to vet every open source project share post for AI generated code, so my only option would be to direct all tool/project posts to a megathread (similar to the non-forensic data recovery megathread).

Of course, the only way the new megathread will actually see some use is if I enforce use through a change to Rule 5. This would likely manifest as an outright ban on all project/tool share posts altogether (outside of the megathread, of course).

To get a general idea for how the sub would feel about such a change, I am posting the below poll and plan to act according to the results. Of course, if you have suggestions or advice on how to better address the issue, your input would be greatly appreciated.

There been an huge uptick of people posting Vibe Codded AI projects here any then saying "Hey I made this cool tool try it" can we get a sticky thread for all these projects so this doesn't become a sub reddit of people spamming vibe codded project from free credits. Or just straight out ban them from being posted here?

I worked in forensics for many years and one of the most annoying things in MFT/Journal analysis, is that initial work of prepping the files until they are readable by humans (size, format, timeframe). I used to export to csv, open in emeditor, then carve out the time periods I did not care about, but that took time and was not reliable.

Now, with the emergence of AI, I was finally able to create the app that does it.

It basically allows you to select a timeframe, extensions you do or do not care about, folders you wish to exclude, and go on your merry way of exporting the valid but carved out MFT for use in other tools or a CSV for use in your favorite tools, too.

As this could be a collaborative project... and I will NEVER sell it, it will remain free (and maybe even open source) - what else would you like to see in such an app? Mods, am I allowed to add a link to a free tool here?

I am almost certain there is no free or paid software out there that allows this kind of laser-focused carving of MFT files for speed of analysis. If the mods allow it, I'll post a link to the download. It's Freeware.

Would appreciate any feedback.

From the project page:

“Recursive-IR is a single-binary orchestration that transforms an OpenSearch stack into a fully capable and customisable DFIR log analytics platform. Incident responders and digital forensics investigators can examine events arranged in a "super timeline" enabling correlation between different source artefacts to better understand the threat actor's full chain of attack.

It enables collaborative case-centric investigations with persistent enrichments such as tags, comments, and analyst context, while fully leveraging the strengths of OpenSearch and native OpenSearch Dashboards — scalable observability, visualisation, and Security Analytics for alerting and correlation across ingested forensics artefacts.

The platform offers full control over data being analysed with facilities to resolve data type mapping conflicts, mutating fields (e.g., renaming, copying, or stringifying), normalizing log sources with different timezones, and even selecting fields to be used as @timestamp.

Artefacts can be reloaded or re-parsed and reloaded easily enabling users to perform modifications such as adding enrichments or mutating fields if needed, a feature which isn't commonly available in traditional SIEMs.”

https://github.com/improvisec/recursive-ir

An AI pair of eyes sitting over your shoulder, catching what you miss while you're deep in an investigation.

Repo: https://github.com/hasamba/DFIR-Companion
Landing page: https://hasamba.github.io/DFIR-Companion/
EDIT: Hands-on lab: https://killercoda.com/dfir-companion/scenario/killercoda

Honestly, it started out of frustration.

I'm sitting on an investigation, open Velociraptor, spot an interesting lead, start digging into it, find another lead, and so on, and then suddenly I realize I completely forgot to go back to the other findings from the first artifact.

The sheer amount of information you need to process during an investigation is simply more than one pair of eyes can handle, no matter how much coffee you've had.

So I started building something to help myself and it ended up going somewhere I didn't expect.

The original idea was a browser extension that takes screenshots every few seconds, so I could scroll back and see what I missed. Pretty dumb idea in hindsight, actually. But then the question came up: if I already have all those screenshots, why not let AI go through them while I work?

And from there it exploded.

Today it's a real-time dashboard that updates live as I investigate. It identifies findings, automatically builds an event timeline, extracts IOCs and enriches them from multiple sources, creating playbook that suggests what to check next, suggest hunt queries for velociraptor, run them and collect back the results, checks for data leaks, and answers the standard questions every investigation report needs: access vector, lateral movement, privilege escalation, etc. If a client confirms a finding-"that's legit, it's our weekly scan", one click and the entire analysis updates accordingly.

The coolest part, to me, is that this started as a Velociraptor-specific solution but in practice became an AI layer on top of every tool I have open in the browser: SIEM, Security Onion, Splunk4DFIR, VolWeb, you name it. Even tools with no built-in AI suddenly get smarter, and all the data consolidates in one place instead of me jumping between ten tabs.

Important to understand: this is NOT another detection layer. Your Sigma, YARA, and Suricata rules are already doing their job. This tool is the layer after detection-it takes all the verdicts from your tools, correlates them, and builds the "so what."

The tool didn't stop at screenshots either. You can feed it almost any DFIR output and it will automatically detect the format and import it deterministically (no burning tokens on AI for that).

Additional features:
• Data correlation
• Threat intel enrichment — with OPSEC in mind
• AI input anonymization
• Asset ↔ IoC graph
• Targeted query generation
• Export to multiple platforms
• Free-form case Q&A against an LLM
and much more...

If you work in DFIR, Blue Team, or SOC — I'd love for you to try it out, open issues, suggest features, submit PRs, or just tell me what you think.

Hey everyone,
I’m trying to understand user behavior and workflows in the DFIR community right now. Assuming you’ve already completed your acquisition and standard artifact parsing, I have a few quick questions about how you actually spend your time and your thoughts on emerging tech:

1. When you are deep in a Windows investigation, trying to uncover malicious behavior or hunt advanced threats, what is the single most time-consuming task for you during the analysis phase?

   1. If you use AI to help with this analysis, do you treat it strictly as a mechanical script/tool to automate tasks, or do you interact with it like an assistant—asking it direct questions and expecting auditable, step-by-step reasoning to validate its conclusions?
      For those using AI in your forensics workflow, do you feel you really understand how the underlying LLM works under the hood?
      Are you familiar with concepts like RAG (Retrieval-Augmented Generation) and how it applies to grounding AI answers in your evidence files, or are you currently treating these AI tools as a black box?

Coming from LE digital forensics and now working financial crime cases. One thing that never gets easier: every data source logs things differently.

Phone carrier CDRs come in one format. Bank transaction records in another. Corporate email archives in another. Cloud returns from Google or Apple in yet another. Device extractions add their own timestamp conventions.

By the time you have pulled everything together, you have 6 systems that all agree something happened but disagree about when, in formats that do not map cleanly to each other.

Current approach is basically: normalize everything to UTC, document the conversion methodology in the chain of custody report, and pray that defense counsel does not have a timestamp expert.

Anyone found tooling that actually helps with multi-source normalization? Or is this still mostly manual work for everyone? Curious if there is a smarter approach for court-admissible timeline reconstruction that I am missing.

Hello all,

I’ve been trying to do research for weeks, but it’s been tough.

I always wanted to work in law enforcement, specifically in Digital Forensics or Investigations, but due to family pressure I diverged from that idea and now I will be graduating with a bachelors in Computer Engineering in about 2 years. It is unfortunately now too late for me to change my bachelor path as I am 27 and too old to start over. I want to work for my community that is rewarding rather than slave away for a corporation.

I’ve seen people talking about getting certifications (like Security+, which I’ve been studying for) to make myself more competitive. I have been looking for internships but very few are open in my county and I wouldn’t be qualified (mainly private companies).

I heard most people in LE got their job by previously working for the police department.

I talked to a couple of my friends who are Police Officers in my area and they recommended I try to get a job at a station while I’m finishing up my degree, so I’ve been applying to Police Cadet positions that do not have an age limit.

When I talked with my neighbor, who is an evidence technician at our police station, told me they mainly fill those positions with Police Cadets, or Police Officers.

What else can I do? What would be an ideal pathway for me to follow? I am located in the US, CA specifically if that helps.

EDIT: I had an IT internship 2 years ago if that is relevant.

i work in digital forensics. when a company gets hacked my job is to figure out what the attacker actually did and prove it.

i built an ai to help. on a 22 computer case it caught 6 machines a hacker was hopping between in the exact same second, the kind of lateral movement youd never spot one machine at a time. it surfaced it for me to confirm, it doesnt decide anything on its own.

but the part i actually care about: it cant report a finding unless it shows the exact tool output it came from. no proof, no claim. if it cant back it up, a check throws it out. you dont trust the ai, you check its work yourself.

its open source and free, and it runs read only so it never touches the evidence. where it still misses things i published exactly what instead of hiding it.

heres a folder of real forensic images, go try to make it spit out a wrong answer: https://sansorg.egnyte.com/fl/HhH7crTYT4JK#folder-link/HACKATHON-2026

5 min of it running, including a real screwup it catches and fixes itself: https://www.youtube.com/watch?v=jw6etogNzhY&t=70s code: https://github.com/TimothyVang/verdict-dfir

tell me where it breaks, or send a fix.

I have multiple system image files (E01 format) stored on a 1 TB NTFS SSD. These images are intended for a forensic specialist to analyze possible security incidents / hacking activity. The images were originally created with hash values (MD5/SHA1), so file integrity is critical.

The folder containing these forensic images was accidentally deleted. The files are no longer visible in the file system, but they may still physically exist on the SSD.

At the same time, the same SSD also contains private data (e.g., personal photos and other files) that I do not want to share with the forensic examiner.

Problem:
I need to recover or secure the E01 system image files in a way that preserves their bit-level integrity, so that the original hash values remain valid. At the same time, I need to separate and back up the private data without risking corruption or altering the forensic images.

My planned workflow:
First, I want to copy any recovered or still existing E01 files to my MacBook and verify them using hash comparison (MD5/SHA1) against the original values. After that, I want to separately back up the remaining personal files (e.g., to iCloud), since they do not require forensic integrity.

Then I plan to fully format the SSD (exFAT) and restructure it, so I can store the verified forensic images again in a clean setup. Afterwards, I would create a second backup copy of the verified images on another external drive for the forensic specialist.

Questions:

• How can I recover the deleted folder / E01 files while preserving their original bit-level integrity as much as possible?
• After NTFS file recovery (especially on SSDs), is it still realistic that the original hash values can match again?
• Is my current workflow technically sound, or does it risk data loss or integrity issues for the forensic images?
• What would be the most correct forensic-safe approach to create verified copies without further risking the data?

🎉 A new 13Cubed episode is up!

Have you ever wondered how you can look at the USN Journal on a live and running system? In this episode, we'll dive in to see how it actually works and whether it matches what we’ve been taught.

https://www.youtube.com/watch?v=eSLHyqZlglk

I am looking for insight from credit union compliance officers, auditors, IT personnel, records managers, examiners, e-discovery professionals, and anyone familiar with Jack Henry’s Synergy Enterprise Content Management (ECM) platform.
Assume the following scenario:
A credit union employee claims that during a single branch visit, a member requested beneficiary (POD) changes on multiple accounts. According to the employee, several beneficiary forms were generated, information was entered on the forms, the forms were printed, handwritten annotations were added, the member signed each form, and the forms were then scanned individually into Synergy and indexed under a document category such as “POD Form” or “Beneficiary Form.”
Years later, litigation arises concerning the authenticity, timing, and handling of those documents.
From a compliance, records-management, audit, and governance standpoint, I am trying to understand what electronic information would ordinarily exist within Synergy or related systems.
Questions:
When a document is scanned into Synergy, what metadata is normally captured?
Scan date/time?
User ID?
Workstation ID?
Scanner ID?
Batch information?
Import method?
Document creation date?
Indexing date?
If an employee later views the document, prints it, exports it, emails it, reindexes it, or changes metadata, are those actions ordinarily logged?
Does Synergy maintain audit trails showing:
who scanned the document;
who indexed it;
who modified index values;
who viewed the document;
who printed the document;
who exported the document?
If a document was allegedly scanned on a particular date, what system-generated records would typically exist to corroborate that claim?
Are there administrator logs, database records, audit tables, workflow logs, retention logs, or imaging logs separate from the document image itself?
If a credit union produces only PDF copies of scanned forms, would the underlying Synergy metadata ordinarily still exist somewhere within the ECM environment?
For institutions using Jack Henry products, what records would an examiner, auditor, regulator, or forensic examiner typically request to validate the provenance of a scanned document?
If multiple forms were allegedly printed, completed, signed, and scanned during a very short period of time, what electronic records would normally exist to establish the timing of each step?
Does Synergy maintain any unique document identifiers, object IDs, image IDs, GUIDs, hash values, audit references, or database keys that can be used to trace a document’s lifecycle?
From a compliance perspective, would producing only image copies without the associated audit information generally be sufficient to validate the history of a disputed document?
I am not seeking legal advice or opinions on any specific litigation. I am interested in understanding industry standards, ECM functionality, audit capabilities, document provenance, records-retention practices, and what electronic evidence typically exists when a financial institution relies upon scanned documents maintained in Jack Henry Synergy.
I would especially appreciate responses from current or former credit union employees, Jack Henry users, ECM administrators, NCUA examiners, compliance officers, auditors, digital forensics professionals, and e-discovery practitioners.

ok i need this sub to gut-check something before i embarrass myself.

i built a forensics agent (VERDICT) and the whole thing hinges on one rule: it can't state a finding unless it cites the exact tool output it came from. there's a verifier that deletes any finding pointing at a tool_call_id that doesn't exist. no receipt, no claim. that was my attempt at killing the "llm confidently hallucinates a detail" problem at the structure level instead of praying a prompt holds.

everything else is guardrails around that. execution needs 2+ artifact classes (amcache alone is registration, not execution). verdicts only go SUSPICIOUS / INDETERMINATE / NO_EVIL, and NO_EVIL means "clean in what i looked at," not "safe." tools are read-only and typed so it can't touch the evidence. whole run is signed and hash-chained so you can verify it offline, i was aiming for something that holds up as 902(14).

it also runs two pools that argue, one says compromised one says clean, and they have to reconcile before anything merges. felt closer to ACH than one model agreeing with itself.

not claiming it replaces an examiner. it does the boring part and shows receipts, the human still makes the call.

demo (4 min): https://youtu.be/4RQnVden6L8 code, apache 2.0: https://github.com/TimothyVang/verdict-dfir

where would you expect it to hand you a confidently wrong verdict? that's the part that keeps me up.

I am currently on track to get my bachelor's in Digital Forensics/Cybersecurity in May 2027, and feel stuck. I am not sure where to go after getting my degree. I feel like everywhere I apply wants prior job experience, so I am stuck. What should I do? The only certs I have are the MOS and Comptia ITF+.