top of page
![](https://static.wixstatic.com/media/11062b_2ccb88c1c6de4151b51879d6c90fca9df000.jpg/v1/fill/w_1920,h_1080,al_c,q_90,enc_avif,quality_auto/11062b_2ccb88c1c6de4151b51879d6c90fca9df000.jpg)
![](https://static.wixstatic.com/media/5fb032_d7bb21c813324dacbb2586e25c806625~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d7bb21c813324dacbb2586e25c806625~mv2.webp)
![Metadata Investigation(Exiftool): A Powerful Tool in Digital Forensics](https://static.wixstatic.com/media/5fb032_d7bb21c813324dacbb2586e25c806625~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d7bb21c813324dacbb2586e25c806625~mv2.webp)
-
12 minutes ago4 min read
Metadata Investigation(Exiftool): A Powerful Tool in Digital Forensics
Metadata, often described as "data about data ," is a treasure trove of hidden information embedded within files. While it’s not...
7 views0 comments
![](https://static.wixstatic.com/media/5fb032_17cdbacf9b7c4f2d96fac473a97f4aa1~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_17cdbacf9b7c4f2d96fac473a97f4aa1~mv2.webp)
![Metadata Recovery: Bringing Deleted Files Back to Life](https://static.wixstatic.com/media/5fb032_17cdbacf9b7c4f2d96fac473a97f4aa1~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_17cdbacf9b7c4f2d96fac473a97f4aa1~mv2.webp)
-
1 day ago3 min read
Metadata Recovery: Bringing Deleted Files Back to Life
When a file is deleted from a computer, it’s not really gone. The data remains on the disk until something else overwrites it . This...
15 views0 comments
![](https://static.wixstatic.com/media/5fb032_e6cfcd7ccf48441bb4ed253386a77aa2~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_e6cfcd7ccf48441bb4ed253386a77aa2~mv2.webp)
![Volume Shadow Copy extraction with KAPE(including data/file recovery)](https://static.wixstatic.com/media/5fb032_e6cfcd7ccf48441bb4ed253386a77aa2~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_e6cfcd7ccf48441bb4ed253386a77aa2~mv2.webp)
-
2 days ago3 min read
Volume Shadow Copy extraction with KAPE(including data/file recovery)
--------------------------------------------------------------------------------------------------------- Before we dive into today’s...
11 views0 comments
![](https://static.wixstatic.com/media/5fb032_d9aa9ee727204dfe8edef2c08c36b2b4~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d9aa9ee727204dfe8edef2c08c36b2b4~mv2.webp)
![Cloud Storage Affect on file Timestamps and collection with KAPE: A Forensic Guide](https://static.wixstatic.com/media/5fb032_d9aa9ee727204dfe8edef2c08c36b2b4~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d9aa9ee727204dfe8edef2c08c36b2b4~mv2.webp)
-
3 days ago5 min read
Cloud Storage Affect on file Timestamps and collection with KAPE: A Forensic Guide
😂 The Final Cloud Storage Article – I Promise! ☁️ I know you all must be thinking, "Another cloud storage article?" But trust me, this...
24 views0 comments
![](https://static.wixstatic.com/media/5fb032_8783294fc830441b8ea34d5bd7ce7886~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_8783294fc830441b8ea34d5bd7ce7886~mv2.webp)
![Box Cloud Storage Forensic Investigations: Logs, Cached Files, and Metadata Analysis](https://static.wixstatic.com/media/5fb032_8783294fc830441b8ea34d5bd7ce7886~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_8783294fc830441b8ea34d5bd7ce7886~mv2.webp)
-
4 days ago4 min read
Box Cloud Storage Forensic Investigations: Logs, Cached Files, and Metadata Analysis
Box is one of the most forensic-friendly cloud storage applications, offering extensive logging, locally cached files, and SQLite...
27 views0 comments
![](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
![Dropbox Forensic Investigations: Logs, Activity Tracking, and External Sharing](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
-
Jan 315 min read
Dropbox Forensic Investigations: Logs, Activity Tracking, and External Sharing
Dropbox presents significant challenges for forensic investigations due to encrypted databases, limited endpoint logs, and obfuscated...
21 views0 comments
![](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
![Investigating Dropbox Forensics](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
-
Jan 314 min read
Investigating Dropbox Forensics
Dropbox has long been a challenging cloud storage service to investigate due to encrypted databases, hidden caches, and complex storage...
29 views0 comments
![](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
![Automating Google Drive Forensics: Tools & Techniques](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
-
Jan 293 min read
Automating Google Drive Forensics: Tools & Techniques
Investigating Google Drive for Desktop can be a time-consuming process, especially when dealing with protobuf-encoded metadata and...
24 views0 comments
![](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
![Decoding Google Drive’s Protocol Buffers and Investigating Cached Files](https://static.wixstatic.com/media/5fb032_d646b2293d8645a797b153ffb885e800~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_d646b2293d8645a797b153ffb885e800~mv2.webp)
-
Jan 283 min read
Decoding Google Drive’s Protocol Buffers and Investigating Cached Files
Google is known for its unique data storage formats , and Google Drive for Desktop is no exception. Unlike JSON or XML , Google Drive...
25 views0 comments
![](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
![Investigating Google Drive for Desktop: A Forensic Guide](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
-
Jan 274 min read
Investigating Google Drive for Desktop: A Forensic Guide
Google Drive is one of the most widely used cloud storage services , integrated seamlessly with Gmail, Google Workspace (G Suite), and...
63 views0 comments
![](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
![Investigating OneDrive for Business: Advanced Forensics & Audit Logs](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
-
Jan 243 min read
Investigating OneDrive for Business: Advanced Forensics & Audit Logs
Microsoft OneDrive for Business is a powerful enterprise cloud storage solution , distinct from the personal OneDrive available by...
29 views0 comments
![](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
![Advanced OneDrive Forensics: Investigating Cloud-Only Files & Synchronization](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
-
Jan 234 min read
Advanced OneDrive Forensics: Investigating Cloud-Only Files & Synchronization
Cloud storage has evolved beyond simple local folder synchronization . Newer technologies, like Files On-Demand and Smart Sync , allow...
65 views0 comments
![](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
![OneDrive Forensics : Investigating Cloud Storage on Windows Systems](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
-
Jan 224 min read
OneDrive Forensics : Investigating Cloud Storage on Windows Systems
Microsoft OneDrive is the most widely used cloud storage service, thanks to its default integration in Windows and its enterprise...
58 views0 comments
![](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
![Forensic Challenges in Cloud Storage Investigations](https://static.wixstatic.com/media/5fb032_f935a43fdc464018be49cf2161368868~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_f935a43fdc464018be49cf2161368868~mv2.webp)
-
Jan 214 min read
Forensic Challenges in Cloud Storage Investigations
With businesses and individuals rapidly shifting their data to the cloud , digital forensic investigations have become more complex....
42 views0 comments
![](https://static.wixstatic.com/media/5fb032_96f57eb40c3d44f5acebdec3df5fa29c~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_96f57eb40c3d44f5acebdec3df5fa29c~mv2.webp)
![Handling Incident Response: A Guide with Velociraptor and KAPE](https://static.wixstatic.com/media/5fb032_96f57eb40c3d44f5acebdec3df5fa29c~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_96f57eb40c3d44f5acebdec3df5fa29c~mv2.webp)
-
Jan 1812 min read
Handling Incident Response: A Guide with Velociraptor and KAPE
Over the 3 years period , I’ve created numerous articles on forensic tools and incident response (IR). This time, I want to take a step...
169 views0 comments
![](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
![SentinelOne Threat Hunting Series P3: Must-Have Custom Detection Rules](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
-
Jan 172 min read
SentinelOne Threat Hunting Series P3: Must-Have Custom Detection Rules
In this article, we continue exploring the power of SentinelOne’s custom detection rules to enhance control over your environment's...
26 views0 comments
![](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
![SentinelOne Threat Hunting Series P2: Must-Have Custom Detection Rules](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
-
Jan 162 min read
SentinelOne Threat Hunting Series P2: Must-Have Custom Detection Rules
In this article, we continue exploring the power of SentinelOne’s custom detection rules to enhance control over your environment's...
35 views0 comments
![](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
![SentinelOne Threat Hunting Series P1: Must-Have Custom Detection Rules](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
-
Jan 142 min read
SentinelOne Threat Hunting Series P1: Must-Have Custom Detection Rules
In this three-part series, we’ll explore custom rules for enhanced threat detection and hunting in SentinelOne . These rules leverage...
49 views0 comments
![](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
![SentinelOne(P10- New SentinelOne Console): A Practical Guide/An Practical Training](https://static.wixstatic.com/media/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_732a9fbddbba4ff594aea9c4cdb2fc9f~mv2.webp)
-
Jan 122 min read
SentinelOne(P10- New SentinelOne Console): A Practical Guide/An Practical Training
As promised, let’s dive into the new SentinelOne console and its features. Here's an overview of what the updated interface looks like:...
43 views0 comments
![](https://static.wixstatic.com/media/5fb032_44db1dce5e8744119db10519944ea1c0~mv2.jpg/v1/fill/w_250,h_250,fp_0.50_0.50,q_30,blur_30,enc_auto/5fb032_44db1dce5e8744119db10519944ea1c0~mv2.webp)
![Tracing Reused $MFT Entries Paths : Recovering Deleted File Paths Forensically with CyberCX UsnJrnl Rewind](https://static.wixstatic.com/media/5fb032_44db1dce5e8744119db10519944ea1c0~mv2.jpg/v1/fill/w_454,h_341,fp_0.50_0.50,q_90,enc_auto/5fb032_44db1dce5e8744119db10519944ea1c0~mv2.webp)
-
Jan 103 min read
Tracing Reused $MFT Entries Paths : Recovering Deleted File Paths Forensically with CyberCX UsnJrnl Rewind
Hey there! If you’ve been following my articles, you might already know the answer to this question. But let me ask it again: If we have...
52 views0 comments
bottom of page