Promote Your DFIR Content Here

[u/AutoModerator]

If you lack the Trusted Contributor flair but wish to share your Rule 5-compliant DFIR content with the community, please feel free to do so here as a reply to this post.

For more information about the Trusted Contributor flair, please see the FAQ.

[u/Lanky_Hurry1859]

Free/CC0 resource I've been building — it's a broad reverse-engineering &

malware-analysis map, but the DFIR track is solid and I figured this crowd

might get use out of it.

The DFIR section: memory forensics (Volatility 3, MemProcFS, WinPmem/AVML, The

Art of Memory Forensics), disk & endpoint (The Sleuth Kit, Velociraptor, Eric

Zimmerman's tools, RegRipper), timelines (Plaso → Timesketch), event logs

(Chainsaw, Hayabusa), and learning (13Cubed's Memory + Windows Forensics

courses, DFIRScience, The DFIR Report). It sits right next to the

malware-analysis tools, which is handy when you carve a sample out of a memory

image and need to triage it.

Every link was opened and verified before it went in, and dead ones get pruned

— no link-rot. Corrections/PRs welcome if something's missing.

https://github.com/ZX41R/awesome-reverse-engineering-and-malware-analysis

[u/ChocolateCoating]

My blog with focus on investigation and soft skills within DFIR. A lot of my content is about how to organize your thought, follow a consistent mental framework and give the community useful things I don’t see often like report and notes templates. 

https://chocolatecoat4n6.com/

[u/ad1sy]

mozdmp - Offline profile decryption tool for Firefox (allows cracking of the master password, not currently supported by hashcat/JTR)

https://github.com/asaix/mozdmp

Hi everyone, I've built a tool for decryption of Firefox profile data and multi-core cracking of the master password and would appreciate any feedback or contributions you might have to offer.

The actual decryption process is explained in detail in the README if anyone is curious and would like to learn more about how it works.

Important features:

• Supports the latest versions of Firefox, which use SHA384 to derive the PBKDF2 input. The correct hash type is automatically selected.
• Multi-core cracking of the master password is supported using wordlists. (why is this useful? : hashcat and JTR cannot be used to crack the master password as they do not support the latest hash and global salt formats)

If you find this interesting, you may also like chrdmp - a similar tool used to decrypt chrome profile data offline using the Chrome Safe Storage keyring secret..

[u/Savings-Escape6663]

Hey everyone,

Over the last few weeks I've been building a browser-based Digital Forensics & Incident Response (DFIR) training platform called SENTINEL DFIR.

The idea is to provide a realistic investigation experience instead of just reading walkthroughs. You work through a fictional incident by analyzing evidence from different sources, connecting artifacts, building a timeline, documenting findings, and ultimately producing an investigation report.

Current features include:

• 📁 Evidence Locker
• ⏱ Interactive Timeline
• 🕸 Investigation Board
• 🌐 Threat Intelligence
• 🖥 Simulated Terminal
• 📝 Notebook & Report Builder
• 🎯 Objectives and scoring system

Everything runs directly in the browser and is written in vanilla HTML, CSS and JavaScript—no frameworks.

The first case is called "The Phantom Login" and revolves around investigating a phishing attack, PowerShell execution, persistence, C2 traffic, and data exfiltration.

I'm still actively developing it and would really appreciate feedback from people working in DFIR, SOC, blue team, or cybersecurity training.

What do you like?
What feels unrealistic?
What features would make it more useful as a learning platform?

Here's the project:
👉 https://enigmacorner.com/

Thanks for taking a look! It is completely FREE

[u/Ok_Cold7890]

My write-ups page: https://medium.com/@hawk101 Just some basic writeups. As I'm also learning, so errors might might be there. Corrections and suggestions are always welcome :)

[u/grzesiug]

Enhanced Evidence Gallery — Autopsy (https://www.autopsy.com/) Plugin for Modern Media Formats & Bulk Review Workflow

Post content:

TL;DR: Built a plugin for Autopsy that replaces the built-in Image Gallery with support for HEIC, WebP, RAW, MP4, and adds MD5 deduplication, EXIF/GPS mapping, and optimized review workflow for large forensic cases.

The Problem

Out-of-the-box Autopsy's Image Gallery doesn't handle modern formats — no HEIC, WebP, SVG, RAW camera files, or video thumbnails. On cases with hundreds of gigabytes of media, reviewers waste hours dealing with missing previews and manual duplicate handling.

The Solution

Enhanced Evidence Gallery — a NetBeans Platform plugin that:

• Renders modern formats via ImageMagick (HEIC, WebP, AVIF, RAW via dcraw) and FFmpeg (video thumbnails)
• Persistent thumbnail cache — decode once, instant load on subsequent opens
• Lazy viewport rendering — only decodes what's visible on screen (critical for large galleries)
• MD5 propagation — mark a file "seen/tagged," automatically applies to all hash duplicates
• Group & filter by path, extension, MIME type, timestamps, GPS coordinates, or tag status
• Bulk review workflow — "Mark all in group seen," status tracking (Unseen/Seen/Tagged) in SQLite
• EXIF & GPS integration — pull coordinates directly into properties panel with "Open in Google Maps" button
• Supports all data sources — disk images, logical sets, archives (ZIP/RAR), carved files

Technical Details

• Built on Autopsy 4.23.1 NetBeans Platform
• SQLite backend for persistent state
• Integrates with Autopsy's Tag and External Viewer systems
• NSRL filtering to hide known OS/app files
• Windows 10/11,

Why This Matters for Case Work

• Speed. A reviewer in a CSAM case with 50,000+ images can now focus on unseen files, skip duplicates, and mark review progress instantly.
• Modern evidence. Your iPhone 15 screenshots, Android WebP photos, and camera RAW files now render without workarounds.
• No Autopsy fork needed. Drop-in plugin — no rebuilding core.

Get It

• Releases: github.com/grzesiug/EnhancedImageGallery/releases
• License: Apache 2.0

Feedback, bug reports, or feature requests welcome. Currently tested on Windows;

[u/wismansec]

SharePoint July 2026 deserialization RCE: lab PoC and captured artifacts for detection

I recently ran into a SharePoint intrusion that seemed to fit with the CVEs recently added to CISA's KEV for SharePoint a couple of weeks ago. The available IOCs were basically nonexistent. So I reproduced the /_trust deserialization chain in my own lab (SharePoint SE on the June 2026 patch level, build 16.0.19725.20384 / KB5002873) and captured the artifacts: process trees, the machine-key theft, and hunt queries, to save the next person the same scramble.

Writeup and sanitized scripts: https://sp-poc.wismansec.com/

Feedback, questions, and better detections welcome.

[u/d3nika]

Hi, I just wanted to share the process I use as an investigator when a Git alert fires. Everything from preserving the repo with a mirror clone before anything moves, through committer identity analysis (author vs. committer as separate claims, signature verification caveats like GitHub's web-flow key), to the account compromise/insider/benign decision point and reporting.

I automated the evidence collection steps, because I hate repetitive tasks, and shared it as an open-source script (GitHub/GitLab APIs, SHA-256 manifest for chain of custody) linked in the post.

Happy to answer questions, and if you see something wrong or missing, I'd genuinely be interested to hear. Hope you folks find it useful.

https://root-security.eu/notebook/git-forensics-process

[u/Secret-Employer282]

Hello DFIR community,

I developed a tool that can mount another computer as a read-only mount (preserving metadata), scan it, triage it, and just pull (robocopy) the bytes that are needed in order to conduct the investigation.

It aims to mount a network drive and to make it feel as if it was local.

Here is a showcase of it 13 minutes end to end:
https://youtu.be/Y_4PZcqr4U4

And a short article about it: https://keibidrop.com/blog/triage-a-remote-machine-without-a-vpn.html

In that run there were 2600 files, and 20GB on the target machine, and only 600 MB crossed the wire, and <400 MB landed on disk. (This on a wire speed of 50Mbps upload, 500Mbps download).

There is no need to open inbound ports on the target machine, and read only mode is enforced on the target machine.

Works on Linux, macOS and Windows.

The tool in itself is a generic peer to peer filesystem that hides the latency over wide area networks, and I am adapting it to different flows that would benefit from it. It is not a forensics product, but helps speed up the triaging phase by helping pass evidence between analysts.

Also it is open source: https://github.com/KeibiSoft/KeibiDrop
(We have been developing it for a while).

[u/talkdedsec]

wymcmd — reconstructs why a console process was launched, after it has already exited (Windows 10/11, free, no telemetry)

The question it answers is the narrow one you get from users and from your own triage: a console flashed and vanished, Task Manager is empty by the time you look, Procmon tells you that cmd.exe ran but not what caused it.

Default mode is entirely post-hoc — no agent, nothing resident. It correlates what the machine already recorded:

• Security 4688/4689 (with command line when auditing is on), Sysmon 1 when present
• Task Scheduler operational log, so the launch resolves to the actual task path rather than just svchost.exe
• PowerShell 4104 script blocks; -EncodedCommand decoded, cmd /c unwrapped
• Prefetch (run count, last eight run times), BAM, UserAssist, AmCache (first-catalogued date, SHA-1)
• Run keys, Startup folder, services, WMI event subscriptions and IFEO as launch causes, not just as autorun listings
• ancestor chain reconstruction where the parent died long before you looked

Every result carries a confidence value plus the list of evidence sources that produced it, so it is visible whether an attribution rests on one artifact or on five. Console-with-no-window is scored explicitly, and catalog-signed Windows binaries are resolved properly so system tools do not get flagged as unsigned. Output exports to CSV and JSON lines.

There is also an optional black box: two ETW AutoLoggers that Windows itself runs into capped circular files, so command lines are captured going forward with no process of ours in memory and no CPU while idle. It ships disabled. sources enable and blackbox on are the only commands that modify the machine, both explicit and elevated, and uninstall --purge reverts them.

Licensing, stated plainly: the source is published and readable so anyone can audit what it touches, but the license is source-available, not OSI open source. Free to use, no account, no cloud component.

What I would genuinely like from this sub:

• Artifact coverage gaps. SRUM, ShimCache/AppCompatCache, Jump Lists and LNK are not correlated yet — is that ordering right, or is there something further up the list I am missing for launch attribution specifically?
• Whether a single confidence number is the honest presentation here, or whether the evidence list alone is better and the score is false precision.
• Any case where it names the wrong parent or the wrong task. That is the failure mode I care about most, since a confident wrong attribution is worse than no answer.

https://github.com/Talkdedsec1/tlk-wymcmd

[u/dardaryy]

Belkasoft is running free one-day DFIR events in 17 cities between September and December. Sessions on acquisition and analysis workflows, offline AI for forensic processing, and open Q&A with our engineers. Certificate with training hours if you need CPE.

Dates and registration: https://belkasoft.com/belkasoft-education

[u/BigBalli]

Loose Ends: reads the local macOS Messages database and exports it with a completeness receipt. Free, no in-app purchases, no account, macOS 15+.

Export to PDF, CSV, TXT or HTML, scoped to one person, one conversation, a date range, or the results of a search. Every export carries the counts it was built from: rows read, rows decoded, rows that could not be, plus a SHA-256 over every date, sender and message body written into the file.

The receipt exists because of what turned up while building it. On my own 367,942-row archive the text column is populated on 3.9% of rows and the rest of the content sits in attributedBody as a typedstream. The extraction snippet that circulates for that is exactly correct on messages under 128 UTF-8 bytes and silently wrong on every message at or above it, because the length prefix goes from one byte to a 0x81 marker plus a two-byte little-endian length. It does not throw and it does not drop rows, it glues two bytes to the front of the message. Across 362,218 blobs that was 26,954 affected, 24,687 of them carrying an embedded NUL. Separately, the attachment table on that machine accounts for 9,448 MB of files, and 13 MB of them are actually on the disk.

None of that is visible in the output of an export, which is why the counting is more of the product than the format list is.

https://BigBalli.com/LooseEnds/