How to boot an Encase (E01) image using VirtualBox
Sometimes, during an incident analysis, you may need to replicate behaviours of a specific host, perhaps already acquired with a forensic method.
Continue…Mobile forensics: how to identify suspicious network traffic
During a forensic analysis on mobile devices, especially when you are not able to perform a full memory acquisition, a network traffic analysis could be useful in order to identify suspicious activities.
Continue…OSX Forensics: a brief selection of useful tools
Today I’d like to share a brief list of useful tools I use for OSX analysis.
Continue…How to extract forensic artifacts from Linux swap
In order to expand the address space that is effectively usable by a process and to expand the amount of dynamic RAM, modern operating systems use the method known as swapping.
Continue…Technology Roundup #18
“Technology is just a tool. In terms of getting the kids working together and motivating them, the teacher is the most important” – Bill Gates
Continue…Musics for a Game Never Born
Several year ago (at least 15), I’ve been involved in a exciting project: the development of a video game. Not as developer, but as musician!
Continue…iOS Forensic: full disk acquisition using checkra1n jailbreak
A simple step-to-step tutorial for iOS full acquisition.
Continue…How to detect Cobalt Strike activities in memory forensics
A brief update on Cobalt Strike detection in forensics analysis, with a couple of new resources.
Continue…Jeffrey Paul: your computer isn’t yours
Some privacy concerns about Apple Silicon and MacOs Big Sur.
Continue…