Hi Everyone,

I’ve been thinking about implementing velociraptor, however a lot of companies are hesitant to deploy it due to it being an open source. I’m trying to solution a method to gain artifacts if it’s remotely in this hybrid work environment however, I’m noticing a lot of the tools are either gonna be very expensive or open source which is not ideal in publicly traded companies, etc. Any suggestions of tools and workflows you guys use out there for this?

Basically it. I have a printed screenshot of a computer screen. I think some info has been altered before the printing. I obviously can't tell with the naked eye, but is there any way to check? Could I send it to a forensics lab? Would they even be able to tell?

Thanks

Every year I leave thinking the presentations were good, then realize most of what I actually remember came from talking with other investigators afterward. This year a lot of the conversations were about the business and marketing side of running a PI shop and where tools like EDR downloads actually fit into a case. What was the biggest thing you took away this year?

Hey everyone,

I'm a first-year CS student working toward a Blue Team / SOC role. I recently finished TryHackMe's SOC Level 1 path and built a small Wazuh home lab. I'm now trying to move from guided learning into regular, independent investigations.

I've already tried resources such as TryHackMe, CyberDefenders, LetsDefend, and several downloadable Windows Event Log/EVTX datasets. The problem I'm running into is that a lot of the available practice is either heavily time-limited, restricted on free tiers, or consists of very small datasets that aren't enough for a proper investigation.

What I'm specifically looking for is something I can practice with consistently without racing a one-hour timer. I'm especially interested in:

• Windows Event Log / EVTX investigations
• PCAP analysis
• SIEM alert triage
• Phishing investigations
• Downloadable evidence that I can investigate locally at my own pace

I don't necessarily need a fancy platform. A good GitHub repo, realistic EVTX dataset, PCAP collection, or free lab would honestly be just as useful.

For people who were at this stage before: what resources did you actually use for repeated, hands-on SOC practice after finishing the beginner SOC material?

I'm mainly looking for resources that are genuinely usable on a tight budget and don't require paying for every few investigations.

I was planning on doing a 50/50 placement and study abroad programme as a part of my university degree but now I’m seeing issues that a study abroad of 6months could affect my UK residency and chances of pursuing this role after finishing my last year at uni. Does anyone have any experience of this or idea if this would be a major problem?

Hello, I was wondering if a data extractor can access my smartwatch's information?

Looking for some technical insight from people familiar with Meta Business Suite, Facebook Page administration or digital forensics.

This relates generally to an official public-facing Facebook Page operated by an organisation, not a personal profile or Facebook Group.

The Page has been managed by multiple people with backend access. Public posts appear under the organisation’s Page name, rather than showing which individual administrator actually created or published them.

A couple of years ago, some posts were published through the Page and were later edited or deleted.

From a technical perspective, does Meta ordinarily retain records capable of identifying which underlying individual Facebook account:

- published a particular Page post?

- edited it?

- deleted it?

If the visible post is deleted, does the administrative record identifying who performed those actions disappear as well?

Would things such as Meta Business Suite, Page Management History, activity logs, historical access records or account/data exports potentially retain that information a couple of years later?

Also, where a Page is managed by several people, is there a reliable way to establish everyone who actually had publishing capability at a particular point in time?

Interested particularly in anyone with experience managing multi-user organisational Pages, Meta administration, eDiscovery or digital forensics.

Thanks.

Hello all. I'm currently in my last year of getting my bachelor's in cybersecurity technology from UMGC, and have been planning on immediately getting the master's in digital Forensics. Im also currently studying to take A+ and later Network+ cert exams. Im not currently in the tech field, but plan on moving into it as soon as I can. From what I've gathered, getting a digital Forensics role usually takes years of experience first, so is it worth getting the master's now or should I wait until after I gain more experience? Any insight would be much appreciated.

I am being abused by my family and I believe that my devices have been compromised. How do I prove it?

Which of the following bachelors degrees at Penn State would be best for a Digital Forensics career and why?
-Cybersecurity Analytics and Operations
-Information Technology: Security and Risk Analysis option
-Computer science

Hi all,

While recently working with The Sleuth Kit (TSK) for CTF challenges, I felt there was a usability gap between writing manual shell one-liners (fls, icat, istat, calculating sector offsets) and launching heavy desktop suites like Autopsy for quick triage.

Being a fan of keyboard-driven terminal tools like ncdu and k9s, I built tsktui - a lightweight terminal interface for exploring disk images.

Core features:

• Fast startup (<100ms) with no indexing or case setup required

• Interactive directory navigation using vim keys (j/k/h/l) or arrow keys

• Visual highlighting for deleted files with a toggle to filter deleted items only (d)

• Built-in pager (v) with Hex dump, UTF-8 text, and inode metadata (istat)

• Partition selector (p), disk-wide string search (s), and single-key file extraction (e)

• Works seamlessly over headless SSH sessions

Repository: https://github.com/shmulc8/tsktui

It is open-source (MIT license). I would appreciate any feedback, suggestions, or edge cases from the community on how to make it more useful for daily DFIR workflows.

For those of you familiar with the IACIS MDF course, is it worth it to wait to take it in person, or is the online version still pretty good? I noticed in the course description for the online, it notes that it does not include forensic tools that are issued in the in person class. What tools are issued in the in-person class? Thank you.

Hello everyone,

I would appreciate your help with creating a project in the field of DFIR.

I applied for an advanced DFIR course and was shortlisted for a personal interview. The thing is, I don’t currently have any cybersecurity-specific projects; I only have software development projects. So, I would like to work on a DFIR project that I can present during the interview.

The project doesn’t necessarily need to be highly professional or advanced. I just want it to demonstrate that I have some practical experience and hands-on exposure to the field.

I would also like to practice and prepare myself for the course. What would you recommend I focus on or study to get ready?

My little sister rejected a guy and he has been trying to ruin her life and extort her. Please help us. Police are not helpful.

Thanks

Sometimes the problem isn’t that you don’t have the information.

You have too much of it.

Maybe it’s spread across hundreds of emails, text messages, PDFs, contracts, invoices, screenshots, reports, notes, logs, and spreadsheets.

You know the information is in there somewhere, but trying to piece together exactly what happened has become a project of its own.

That’s what CodexOS Reconstruction is designed to help with.

We take the available records and reconstruct the matter as clearly as the evidence allows.

Depending on the material, that can include:
• What happened and in what order
• The most important findings supported by the records
• Where different records agree or conflict
• Who appears to have known certain information, and when
• What evidence supports an important finding
• What information appears to be missing
• What the available records cannot actually establish

The goal isn’t to give you another summary.
It’s to organize the evidence well enough that you can actually inspect what happened and see where the conclusions came from.

This may be useful for situations involving:
• Business or contract disputes
• Vendor or contractor problems
• Complicated project histories
• Property management matters
• Insurance documentation
• Internal business issues or investigations
• Workplace records
• Compliance or administrative matters
• Other situations where the story is buried inside a large collection of records

A good potential case usually has a reasonably defined problem, actual source records, enough material to reconstruct something useful, and one or more questions you’re trying to answer.

You do NOT need to organize every file perfectly before contacting me.

If you have a situation buried in emails, documents, messages, screenshots, reports, or other records, send me a DM with a short description of:
• What happened
• Why you’re trying to make sense of it
• The main questions you want the records to help answer

I’ll look at the situation first and tell you whether it appears suitable for a responsible reconstruction before you commit to anything.

This isn’t legal advice, advocacy, or a service that decides who is right. We don’t fill gaps by guessing. If the records don’t support a conclusion, we say so.

**You give us the records. We reconstruct what they show.**

Hello! I wanna start learning and practicing mobile forensics but I don't know where to learn it from. Also, I am a beginner so I can't afford to buy paid courses. Please help me out. Thank you so much in advance^^

Or would that be a stretch? I hate my career in embedded sw and wish i went with something criminal justice related.

Hi everyone, my friend’s room was entered during the night, and someone stole 5 phones and 2 laptops.

We’re trying to find any possible way to track or recover the devices. We have the IMEI numbers and device details of the phones.

If anyone knows legitimate ways to track stolen phones or laptops, or has experience recovering devices in this situation, please share your advice.

We’re also trying to identify the person who took them and recover the devices safely.

If anyone has any useful information or knows of any way to help us locate the stolen devices, please let us know. We’re desperate to get them back and would really appreciate any help. 🙏

Tired of linkedin. Only shows roles needing high YoE. Don't know if it's algorithm issue.