Every disk-based forensic technique I'd worked through earlier in this series shared one limitation: a disk image only shows what was written to storage. A sophisticated attack often doesn't look like
Deleting a disk partition feels, to an attacker trying to cover their tracks, like a clean way to make an entire set of files disappear at once. One action, and a whole section of the disk, every file
Every recovery technique I'd worked through earlier in this forensics series depended on the file system still knowing something about the file in question, a deleted entry that could be found, a hash
Every forensic tool I'd worked through up to this point operated on one file at a time: hash a file, check a hash, open a file to verify its format. This lab moved to a different scale entirely, takin
An attacker trying to sneak a file past a network administrator doesn't need sophisticated malware if a simpler trick works just as well: rename the file, change its extension, and let the system's ow
The previous lab in this module was about looking a hash up against the outside world, checking a suspicious file against VirusTotal's malware database. This one flipped the direction entirely: compar
Every cryptography lab I'd worked through before this one treated hashing as an integrity check: has this file changed since I last looked at it? This lab reframed the same tool for a different discip
Most of the labs I'd worked through up to this point focused on one specific control at a time: a firewall rule, an IAM policy, a single detection. This lab was different. It was a capstone exercise b
Most people treat the Recycle Bin, and emptying it, as the final word on a deleted file. This lab walked through why that assumption is wrong, and why both sides of that fact matter for a network defe
