SleuthiferNotes on digital forensics, incident response, memory analysis and KQL for Sentinel.https://sleuthifer.nz/ en Tue, 29 Sep 2026 10:56:43 -0000 Tue, 29 Sep 2026 10:56:43 -0000 1440 MkDocs RSS plugin - v1.19.0 https://sleuthifer.nz/assets/images/logo.png Sleuthifer https://sleuthifer.nz/ Cipher (Anti-forensics) How Cipher.exe /w overwrites deleted data, tested on a USB drive and checked in FTK Imager. https://sleuthifer.nz/blog/cipher/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/cipher/ File Carving File carving concepts (sectors, clusters, file size and fragmentation), then manually carving a deleted file from a FAT32 file system with FTK Imager. https://sleuthifer.nz/blog/file-carving/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/file-carving/ FTK Imager An intro to FTK Imager, then creating and verifying an E01 forensic image of a USB drive. https://sleuthifer.nz/blog/ftk-imager/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/ftk-imager/ Part 1: Memory and Volatility An introduction to examining RAM with volatility https://sleuthifer.nz/blog/part1-memory-and-volatility/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/part1-memory-and-volatility/ PowerShell History Where to find the PowerShell history file. https://sleuthifer.nz/blog/powershell-history/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/powershell-history/ Threat Intelligence & Intrusion Analysis Threat intelligence feeds, IoCs and IoAs, the Pyramid of Pain, the Cyber Kill Chain, MITRE ATT&CK and the Diamond Model. https://sleuthifer.nz/blog/threat-intelligence/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/threat-intelligence/ Wireshark An intro to Wireshark, then using Protocol Hierarchy and a DHCP filter to identify a laptop, and following a TCP stream to decode an SMTP login. https://sleuthifer.nz/blog/wireshark/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/wireshark/ You've been hit, popped or breached? A quick and frank article on what should happen if you are unfortunate to be involved in a cyber security incident. https://sleuthifer.nz/blog/youve-been-hit-popped-or-breached/ Sun, 27 Sep 2026 00:00:00 +0000 Sleuthiferhttps://sleuthifer.nz/blog/youve-been-hit-popped-or-breached/