DFIR

Digital forensics and incident response. Disk, memory and artifact analysis, plus blue-team operations: logs, SIEM, IDS and incident handling.

Start here: Forensics Fundamentals17 notes

Forensics

AutopsyFebruary 12, 2026type sudo autopsy in the terminal Open http://localhost:9999/autopsy in Firefox Select New case Case Name: The name of this investigation == اسم التحقيق/ القضية it is like the…
DFIR & Steganography Cheat-Sheet · Anas EducationFebruary 12, 2026هاد الملف فيه ملخص منظم على الأدوات والتقنيات اللي تهمّ DFIR (Digital Forensics & Incident Response) وبالخصوص قسم steganography (audio, image, video) وكذا شوية ملاحظات على…
Disk/Image AnalysisFebruary 7, 2026When an attack happens on a computer in a company for exemple , we need the DFIR team (Digital Forensics and Incident Response) to analyze the incident.
File Signatures for SteganographyFebruary 12, 2026Magic number = lbdya dyal lfile (1-4 bytes) li katban finno type dyal lfile. Ex: FF D8 FF = JPEG Ex: 89 50 4E 47 = PNG Ex: 25 50 44 46 = PDF
Forensics FundamentalsFebruary 12, 2026Cyber crime includes any illegal activity using digital devices.
Linux Forensics: Top 20 Locations to Find the FlagFebruary 12, 2026In Linux CTFs, flags are often hiding in plain sight, tucked into configuration files, or buried in the history of what users typed. This guide will walk you through the top 20…
Memory Forensics with Volatility 3February 12, 2026هاد ال-writeup مخصّص لـ Volatility 3 باش يعاونك تدير memory forensics فـ CTF ولا في تحليل حادثة. غادي تلقى هنا لائحة plugins مهمّين، شنو كيديرو، كيفاش تستعملهم بالـ commands،…
Windows Forensics: Top 20 Locations to check in the disk file for windowsFebruary 12, 2026This guide is your roadmap to finding hidden flags in Windows systems during CTF competitions and digital forensic investigations. We'll cover the top 20 locations where flags…

Blue Team