📌 Introduction

This is the first time I have participated in the NCSC CTF and I was able to solve all the forensics challenges and this is my writeup for…

Conducting forensic analysis of a compromised endpoint using MFTECmd, Timeline Explorer, and HxD Hex Editor.

A critical network infrastructure has encountered significant operational disruptions, leading to system outages and compromised machines…

In recent days, we have discovered that some emails from MarsSecure Corp have been leaked, and there have been multiple unauthorized…

As a forensic investigator at IResponseDash, you are tasked with examining a ransomware attack that has compromised multiple endpoints…

Your organization experienced a security incident on May 5, 2025, when the Security Operations Center (SOC) detected suspicious activity…

A company’s web server has been breached through their website. Our team arrived just in time to take a forensic image of the running…

The Investigating Windows machine on TryHackMe presents a compromised Windows Server host. The challenge revolves around analyzing…

Have you ever wondered what really happens when you “delete” a file? In most cases, that file isn’t truly gone — it’s simply hidden from…

My complete walkthrough of TryHackMe’s Windows Forensics 1 investigation

Computer forensics is an essential field of cyber security that involves gathering evidence of activities performed on computers.

Learn about the different file systems commonly used by Windows and where to look in these file systems when looking for artifacts.

Windows truly is a beautiful operating system (although Linux is superior 🤫).

Introduction

What happens when the attacker isn’t a stranger on the internet but a colleague who already knows where the sensitive files live?

Introduction

A Windows workstation has been flagged for unusual activity. Examine its event logs, follow the sequence of suspicious actions, and piece…

Trace an intrusion through Windows event logs and uncover what happened on the workstation.

A trusted Windows utility downloaded a second-stage script onto the host. The command that called the utility obscured its name with a…