284 Followers
51 Following
199 Posts
Dfir
Week 22 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage DFIR+AI Primer: How to Com…

This Week In 4n6
Week 21 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrea Fortuna PowerShell DFIR 2026: from MemPro…

This Week In 4n6
Week 20 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett Why iOS and Android Handle GPS Di…

This Week In 4n6
Week 19 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Chad Gish at Magnet Forensics Windows forensics:…

This Week In 4n6
Week 18 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett A Digital Forensic View: How iOS …

This Week In 4n6
Week 17 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6

While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to.

We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper
https://thinkdfir.com/2026/04/25/trust-but-verify-amcaches-originalfilename-field-isnt-always-accurate/ #DFIR

Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate

During an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper. Mostly this is a call for help, and an explanation of how to test! TLDR Sometimes AmC…

ThinkDFIR

Week 16 - 2026 #DFIR

https://thisweekin4n6.com/2026/04/19/week-16-2026/

Week 15 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6
Week 14 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6