Mastodawn

Week 22 - 2026 #DFIR
https://thisweekin4n6.com/2026/05/31/week-22-2026/

Week 22 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage DFIR+AI Primer: How to Com…

This Week In 4n6

Phillmoore May 24

Week 21 - 2026 #DFIR
https://thisweekin4n6.com/2026/05/24/week-21-2026/

Week 21 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrea Fortuna PowerShell DFIR 2026: from MemPro…

This Week In 4n6

Phillmoore May 17

Week 20 - 2026 #DFIR
https://thisweekin4n6.com/2026/05/17/week-20-2026/

Week 20 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett Why iOS and Android Handle GPS Di…

This Week In 4n6

Phillmoore May 10

Week 19 - 2026 #DFIR
https://thisweekin4n6.com/2026/05/10/week-19-2026/

Week 19 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Chad Gish at Magnet Forensics Windows forensics:…

This Week In 4n6

Phillmoore May 3

Week 18 - 2026 #DFIR
https://thisweekin4n6.com/2026/05/03/week-18-2026/

Week 18 – 2026

If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett A Digital Forensic View: How iOS …

This Week In 4n6

Phillmoore Apr 26

Week 17 - 2026 #DFIR https://thisweekin4n6.com/2026/04/26/week-17-2026/

Week 17 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6

Phillmoore Apr 25

While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to.

We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper
https://thinkdfir.com/2026/04/25/trust-but-verify-amcaches-originalfilename-field-isnt-always-accurate/ #DFIR

Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate

During an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper. Mostly this is a call for help, and an explanation of how to test! TLDR Sometimes AmC…

ThinkDFIR

Phillmoore Apr 19

Week 16 - 2026 #DFIR

https://thisweekin4n6.com/2026/04/19/week-16-2026/

Phillmoore Apr 12

Week 15 - 2026 #DFIR

https://thisweekin4n6.com/2026/04/12/week-15-2026/

Week 15 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6

Phillmoore Apr 5

Week 14 - 2026 #DFIR

https://thisweekin4n6.com/2026/04/05/week-14-2026/

Week 14 – 2026

Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

This Week In 4n6