The AI Conversation I've Been Avoiding

Mac Imaging Made Easy with Fuji

Tracking Program Execution with a Little Known Registry Key

The Truth About Windows Explorer Timestamps

Major Update to 13Cubed Courses: Chaos at Cobalt

13Cubed AMA - Answering Your Questions!

The Easy Way to Analyze Linux Memory

Will AI Replace Digital Forensics Experts?

Behind the Book: Threat Hunting macOS with Jaron Bradley

Windows Memory Forensics Challenge

New Course! Investigating macOS Endpoints

A New(ish) Way to Detect Process Hollowing

RADAR Contact! An Obscure Evidence of Execution Artifact

Be Kind, Rewind... The USN Journal

NTFS FILE Record Reuse

13Cubed XINTRA Lab Walkthrough

Linux Memory Forensics Challenge

Shimcache Execution Is Back - What You Need to Know!

Mounting Linux Disk Images in Windows

New Course! Investigating Linux Devices

The Weird Windows Feature You've Never Heard Of

The Ultimate Guide to Arsenal Image Mounter

Where's the 4624? - Logon Events vs. Account Logons

RDP Authentication vs. Authorization

Investigating Windows Courses

Hyper-V Memory Forensics - MemProcFS to the Rescue!

An Important Change to ShellBags - Windows 11 2023 Update!

VMware Memory Forensics - Don't Miss This Important Detail!

Old School MS-DOS Commands for DFIR

Detecting PsExec Usage

A File's Life - File Deletion and Recovery

Two Thumbs Up - Thumbnail Forensics

Interview with Lesley Carhart (hacks4pancakes)

It's About Time - Timestamp Changes in Windows 11

EZ Tools Manuals Interview with Andrew Rathbun

A New Program Execution Artifact - Windows 11 22H2 Update!

The Dissect Effect - An Open Source IR Framework

Let's Talk About MUICache

Impacket Impediments - Finding Evil in Event Logs

What's on My DFIR Box?

MemProcFS - This Changes Everything

Anatomy of an NTFS FILE Record - Windows File System Forensics

The Case of the Disappearing Scheduled Task

Windows Hibernation Files - A Look Back in Time

Let's Talk About NTFS Index Attributes

Puzzling RDP Cache - Putting the Pieces Together

Detecting NTDS.DIT Theft - ESENT Event Logs

EventTranscript.db Deep Dive - New Windows Forensic Artifact!

Event Log Chainsaw Massacre - Powerful Threat Detection

User Access Logging (UAL) Forensics

RDP Hashes - Event ID 1029 Explained

Let's Talk About Shimcache - The Most Misunderstood Artifact

Introduction to MFTECmd - NTFS MFT and Journal Forensics

Dumping Processes with Volatility 3

The ABCs of WMI - Finding Evil in Plain Sight

Profiling Network Activity with Volatility 3 - GeoIP from Memory

Hashcat for Forensics - How Did They Get In?

Plaso and WSL 2 - The WSL Adventures Continue...

Volatility 3 and WSL 2 - Linux DFIR Tools in Windows?

Getting Started with Plaso and Log2Timeline - Forensic Timeline Creation