mac_apt v0.6 is now available. Big new features-
🔐Encrypted APFS images supported
🔓T2 APFS AFF4 images supported
⏳FAST mode for quick results!
github.com/ydkhatri/mac_a…
#DFIR #mac4n6

Are we going to stop calling it Amcache?? #DFIR

thinkdfir.com/2026/09/04/are…

DRIFT Linux is born🐧

A #Linux distro built for #DigitalForensics & #IncidentResponse (#DFIR): a portable lab for device and disk acquisition, Web/Cloud evidence collection, and early stages of incident analysis.
driftlinux.org/blog/technical…

#linux #cybersecurity #forensics #cyber

Video demo of the NTUSER dot MAN trick I saw floating around before the new year -- I did not know this was a thing👀 Hat tip to DeceptIQ et al.... we showcase:

1. breaking a Windows login with an empty user profile,
2. getting initial access EZPZ with a Sliver C2 implant,
3. and hijacking an existing target user profile NTUSER.DAT or HKCU Registry hive,
4. converting hives from .reg plaintext to binary with the HiveSwarming.exe tool,
5. and establishing persistence with the new backdoored NTUSER dot MAN profile we upload!

No Registry writes, API calls or registry callbacks because it's just a single file placed on disk! Kinda neat.

This is my first recording after a month break for the holidays and it was _painful_ -- lots of fails and mistakes and it took many hours 😅

I'm experimenting with MEMES in the THUMBNAIL and SHORT video TITLES to MITIGATE against CLICKBAIT

Also experimenting with longer social text promos for video releases to add more preview details and context. I no longer have to just feed algorithms, but now LLMs, too!

Feels good to get something out the door again. I hope you take a look! YouTube link: youtu.be/Mw8DVcLSZIc

QUANTUMSTRAND beta 1 released: built for analysts to quickly understand *where* strings are, *what* they might be, and *how* important they are, without getting lost in a sea of undifferentiated text.

Thanks @m_r_tz and the crew at @Mandiant FLARE

github.com/mandiant/flare…

🛠️ FJTA update released (2025-08-18)!

Changes include:
✅ No longer requires TSK 4.13.0 for XFS recognition
✅ Minor code refactoring

🔗 github.com/mnrkbys/fjta
#DFIR #Linux

mac_apt v1.26.1 is here, now supports processing Velociraptor collections and compiled versions for macOS too. Many incremental updates and new plugins (we are at 52 plugins now!).
github.com/ydkhatri/mac_a… #DFIR #macOS

🛠️ FJTA update released (2025-07-29)!

Changes include:
✅ Improved parsing of XFS journal log records
✅ Enhanced handling of directory entries (ext4/XFS)
✅ Minor bug fixes

🔗 github.com/mnrkbys/fjta
#DFIR #Linux

Introducing Phorion. A modern EDR platform purpose-built for macOS.
Because security teams shouldn’t have to settle for Windows-first tools. 🛡️🍎
🧵

Found an interesting location storing wifi connect/disconnect information on #macos
#DFIR
swiftforensics.com/2025/01/new-wi…

Hi, #DFIR guys,
I am developing a new forensic tool for parsing journal data of #Linux filesystems (not systemd journal logs).
It can not only parse filesystem journals but also generate timeline events for DFIR.
This tool currently supports only EXT4, but I plan to add support onally, it can detect suspicious activities such as timestomping.
The tool is still incomplete, so it will take at least a few more weeks before the first release.

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR

malwaremaloney.blogspot.com/2025/01/onedri…

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

If you've had this problem (see pic), NTFS Journal REWIND solves it! . New blog post + code. No more unknown paths.
cybercx.com.au/blog/ntfs-usnj…
#NTFS #DFIR

Windows Thumbnail caches are a mostly unused artifact. Did you know they can point to paths on external systems? (Yes path embedded in thumbcache file, not from win search db) Can be helpful when threat actors actively delete logs and other artifacts! #DFIR

🆕 mac_apt release v1.5.8
New modules, macOS 13 & RSR support, Python 3.10 compatibility, easier installation, bug fixes
github.com/ydkhatri/mac_a…
#DFIR #macOS

Hey #DFIR & #Malware community. A memory forensics case were you are required to analyze a memory dump of a Windows 10 system that has been hit with a #Ransomware. Let the games begin. Please share!

$100 bounty will be paid to whoever solves this case! ashemery.com/dfir.html#Memo…

Thanks for merging it @MarkBaggett. Excel output now has autowidth adjustment and auto filter applied, with frozen top row for easy analysis.

🛠️ Just released a new open-source utility: "DumpBTM"

It can dump the persistence records of installed items (including persistent malware!) from macOS's proprietary BackgroundItems-v4.btm file.

Read more:
patreon.com/posts/77420730

ODL parser now updated to unobfuscate encrypted strings. MS had changed the format.. Short blog post sharing the details: swiftforensics.com/2022/11/readin… #DFIR

📌 Drivers abused by #Ransomware TA to kill AV/EDR's

▪ gdrv.sys (Gigabyte) > #RobinHood
9ab9f3b75a2eb87fafb1b7361be9dfb3

▪ aswArPot.sys (Avast) > #CUBA and #AvosLocker
a179c4093d05a3e1ee73f6ff07f994aa

▪ mhyprot2.sys (Genshin Impact) > #Rever
4b817d0e7714b9d43db43ae4a22a161e