13Cubed

13Cubed XINTRA Lab Walkthrough

Linux Memory Forensics Challenge

Shimcache Execution Is Back - What You Need to Know!

Mounting Linux Disk Images in Windows

New Course! Investigating Linux Devices

The Weird Windows Feature You've Never Heard Of

The Ultimate Guide to Arsenal Image Mounter

Where's the 4624? - Logon Events vs. Account Logons

RDP Authentication vs. Authorization

Investigating Windows Courses

Hyper-V Memory Forensics - MemProcFS to the Rescue!

An Important Change to ShellBags - Windows 11 2023 Update!

First Look at Windows Terminal

Introduction to Memory Forensics

Juicy PDFs

How Many Timestamps??? #Shorts

Cooking with CyberChef

Introduction to Windows Forensics

Prefetch Deep Dive

Plaso and WSL 2 - The WSL Adventures Continue...

Old School MS-DOS Commands for DFIR

Lets Talk About MUICache

Its About Time - Timestamp Changes in Windows 11

A New Program Execution Artifact - Windows 11 22H2 Update!

Email Header Analysis and Forensic Investigation

The Dissect Effect - An Open Source IR Framework

Windows Process Genealogy

Recycle Bin Forensics

Windows MACB Timestamps (NTFS Forensics)

Let's Talk About NTFS Index Attributes

Introduction to Redline

Browse Volume Shadow Copies on a Live Windows System

User Access Logging (UAL) Forensics

Windows NTFS Index Attributes ($I30 Files)

Anatomy of an NTFS FILE Record - Windows File System Forensics

Introduction to MFTECmd - NTFS MFT and Journal Forensics

NTFS Journal Forensics

Linux Memory Forensics - Memory Capture and Analysis

Linux Forensics! First Look at usbrip

LNK Files and Jump Lists

RDP Hashes - Event ID 1029 Explained

Two Thumbs Up - Thumbnail Forensics

Getting Started with Plaso and Log2Timeline - Forensic Timeline Creation

Detecting PsExec Usage