Hamdan (@devmuhakeem) header
Hamdan (@devmuhakeem) profile picture

ChemE | WordPress Developer | CMS Expert | Social Media & Community Manager | Open to Remote & Freelance Opportunities | Web3 lover ❤️

Nigeria, Lagos
Joined November 2022
Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)
1/ Worked through a network forensics lab analyzing four separate packet captures with Wireshark, four completely different attacks. The real skill was knowing which filter to reach for each time. Thread below. muhakeem.hashnode.dev/four-a… builder.aws.com/content/3Lov…
1
5
7/ Traced it manually, then confirmed two more ways: an I/O graph showing a clear packets/second spike, and protocol hierarchy stats showing wildly disproportionate TCP volume. Three independent angles, same conclusion.
1
8/ Last: ARP poisoning. Wireshark basically handed me this one, it has a built-in "duplicate IP address detected" warning, exactly the signature spoofing produces. One filter, immediate confirmation.
2
8/ pslist confirmed the process directly. Then went further than Redline's interface showed: used the handles plugin on the specific suspicious PID to list every file and registry key that exact process had open while running.
1
1
9/ pstree confirmed the full ancestry chain matched exactly: spoolsv.exe → rundll32.exe → rundll32.exe → cmd.exe → calc.exe.
3
8/ Selected the Lost Partition-1 entry at the top level, not individual files, selecting the entire recoverable dataset at once. Recovery began writing the full reconstructed partition to the prepared destination.
1
9/ Honest note: the free trial paused partway through with a premium upsell, which I declined. A trial-software limitation, not part of the actual technique. EaseUS still organized what it recovered into a timestamped folder.
2