UUIDv1 has a timestamp & node ID, which can be the MAC address of the machine it was generated on (or random; it depends 🤷‍♂️).

Unfurl 🌿 can extract the timestamp & node ID from a UUIDv1 and look up the vendor if it's a real MAC address.

Unfurl example: https://dfir.blog/unfurl/?url=a28cad70-0d73-11ea-aaef-0800200c9a66

#Unfurl #DFIR #OSINT