https://re4perz3d.github.io/tags/dfir/Recent content in Dfir on Re4perZ3dHugoenSat, 10 Oct 2026 00:00:00 +0000https://re4perz3d.github.io/certs/ecir/Sat, 10 Oct 2026 00:00:00 +0000https://re4perz3d.github.io/certs/ecir/A hands-on incident-response certification: detecting, scoping and responding to a live compromise from host and network artifacts, end to end.https://re4perz3d.github.io/cheatsheets/forensics/Thu, 01 Oct 2026 00:00:00 +0000https://re4perz3d.github.io/cheatsheets/forensics/My full DFIR reference: memory, disk, Windows artifacts, Eric Zimmerman tools, log analysis, network forensics, malware triage, steganography and CTF tricks.https://re4perz3d.github.io/writeups/cybertek/operation-ghostvein/Fri, 29 May 2026 00:00:00 +0000https://re4perz3d.github.io/writeups/cybertek/operation-ghostvein/A Linux DFIR challenge I authored: reconstructing an OFBiz exploitation, PAM backdoor, SSH pivot and DNS exfiltration from host artifacts and PCAPs.https://re4perz3d.github.io/writeups/securinets-beginner-ctf-2025/intro-to-volatility/Mon, 10 Nov 2025 00:00:00 +0000https://re4perz3d.github.io/writeups/securinets-beginner-ctf-2025/intro-to-volatility/Windows memory forensics with Volatility 3: extracting system info, spotting malicious activity and recovering a file hash from a memory dump.https://re4perz3d.github.io/writeups/securinets-beginner-ctf-2025/obfuscated/Mon, 10 Nov 2025 00:00:00 +0000https://re4perz3d.github.io/writeups/securinets-beginner-ctf-2025/obfuscated/Network forensics: extracting an obfuscated JavaScript file from HTTP traffic, deobfuscating it and decoding a reversed Base64 flag.https://re4perz3d.github.io/writeups/cyberspark-ctf/backdoor/Sun, 18 May 2025 00:00:00 +0000https://re4perz3d.github.io/writeups/cyberspark-ctf/backdoor/Analyzing SSH logs to uncover unauthorized access and a malware persistence mechanism.https://re4perz3d.github.io/writeups/cyberspark-ctf/hello/Sun, 18 May 2025 00:00:00 +0000https://re4perz3d.github.io/writeups/cyberspark-ctf/hello/Network forensics and password cracking: recovering an encrypted PDF shared over FTP and extracting the hidden flag.https://re4perz3d.github.io/writeups/htb-sherlocks/teamwork/Thu, 10 Apr 2025 00:00:00 +0000https://re4perz3d.github.io/writeups/htb-sherlocks/teamwork/A phishing-to-supply-chain-attack investigation: tracing a fake NFT game pitch from a North Korean threat actor (Moonstone Sleet) through a trojanized PuTTY and a malicious npm package.