#forensics

Four kinds of traces, which ones attackers can erase, and seven principles that turn a missing log into a lead.

Why a compromised SiteGuard host undermines WAF-produced evidence for CVE-2026-106931, and how to order collection, verification and patching so local evidence survives.

How to recover a deleted, still-running payload straight from /proc on Linux, and why 'rm' never erases the evidence.

October 25, 2026 On October 15th, the 44% problem was named: the reality that nearly half of all...

Imagine receber uma única prova digital que pode definir um processo de milhões de reais — e...

The world of cybersecurity often feels like a crime scene investigation. We spend hours analyzing...

mtime can be forged with touch -d. ctime and birth time can't. A one-line find/awk check that exposes timestomping.

When a ransomware note flashes across a corporate screen at 3 a.m., the clock is already working...

Imagine receber um e-mail às 3h da manhã informando que todos os arquivos da sua empresa foram...

A disk image (.img) is provided. With mmls we locate the partition table and the starting offset,...

Reading Retium's public testnet from its own API: RTM is held at a dollar until the billionth coin is sold, the company keeps the reserve's interest and 8.5% of fees, one keeper executes every transaction, and validator seats are already on sale.

Every digital footprint tells a story. In my two decades working across digital forensics and Web3...