Author Archives: [email protected]

About [email protected]

[Between Teams of Red and Blue, I'm with the Purple Team]

Challenge #9 – Encrypt Them All Case

In this case you are required to decrypt all the data and files that have been encrypted using different crypto methods. E01 for the drive could be found: here #1: Lost in Space: We noticed that the whole communication started … Continue reading

Posted in Anti-Forensics, Challenges, DFIR, Forensics, Investigations, Windows | Tagged , , , , , , | Leave a comment

Challenge #8 – NTFS File System Case

In this case you are required to find all the data and files that have been hidden using some of the NTFS file system capabilities. – E01 for the drive could be found: here – There are 5 hidden things … Continue reading

Posted in Challenges, DFIR, File Systems, Forensics, Investigations, Windows | Tagged , , , , , , , | Leave a comment

Challenge #7 – SysInternals Case

The user downloaded what they thought was the SysInternals tool suite, double-clicked it, but the tools did not open and were not accessible. Since that time, the user has noticed that the system has “slowed down” and become less and … Continue reading

Posted in Challenges, DFIR, Forensics, Investigations, Malware | Tagged , , , , , , | Leave a comment

Prevent Windows Reboots on Expired VMs

Sometimes you have one of those VMs that you downloaded from Microsoft and then you used it for some testing. Now, after a certain amount of time, the free license given will expire and what will happen, is the VM … Continue reading

Posted in Security, Virtualization, Windows | Tagged , , , , , , , | Comments Off on Prevent Windows Reboots on Expired VMs

Windows Kernel Debugging Using Two VMs on Linux

Just thought of writing this here, because I keep forgetting how to do this stuff! Also, since OST2 has lots of new courses related to Windbg, I thought this would be helpful for folks who use a Linux Workstation and … Continue reading

Posted in Exploitation, Kernel, Virtualization, Windows | Tagged , , , , | Comments Off on Windows Kernel Debugging Using Two VMs on Linux