1/ Worked through a network forensics lab analyzing four separate packet captures with Wireshark, four completely different attacks. The real skill was knowing which filter to reach for each time. Thread below.
muhakeem.hashnode.dev/four-a…
builder.aws.com/content/3Lov…
7/ Traced it manually, then confirmed two more ways: an I/O graph showing a clear packets/second spike, and protocol hierarchy stats showing wildly disproportionate TCP volume. Three independent angles, same conclusion.
1/ Worked through a memory forensics lab analyzing a Windows RAM dump with Redline and Volatility. Genuinely different kind of investigation from disk forensics, this shows what was actually running live. Thread below.
muhakeem.hashnode.dev/findin…
builder.aws.com/content/3LnL…
8/ pslist confirmed the process directly. Then went further than Redline's interface showed: used the handles plugin on the specific suspicious PID to list every file and registry key that exact process had open while running.
1/ Worked through a forensics lab on recovering an entire deleted disk partition, not just individual files. Extends a principle from an earlier lab up to a much bigger scale. Thread below.
muhakeem.hashnode.dev/recove…
builder.aws.com/content/3LmG…
github.com/devmuhakeem/Recov…
8/ Selected the Lost Partition-1 entry at the top level, not individual files, selecting the entire recoverable dataset at once. Recovery began writing the full reconstructed partition to the prepared destination.
