A 1.47 MB JPG caught my attention today. It looked out of place in the folder. I took a look under the hood. Using Steghide, I found an embedded ref.xml file inside the image. To a regular user, it's just a JPG. It can be shared, uploaded, or passed around without anyone realizing they're helping transport hidden data. This is what secret communication can look like in plain sight. It also got me thinking about Alternate Data Streams (ADS) vs Steganography. Both can be used to hide data inside or alongside another file. The difference is where the data is stored and what forensic artifacts are left behind. 𝐀𝐃𝐒 (𝐍𝐓𝐅𝐒): Data is stored in an alternate stream associated with the file. The primary data stream remains unchanged, and the additional stream isn't normally visible through standard Explorer browsing. 𝐒𝐭𝐞𝐠𝐚𝐧𝐨𝐠𝐫𝐚𝐩𝐡𝐲: Data is embedded into the container itself. Depending on the technique, this can affect the file's structure, metadata, size, or other measurable characteristics. Same objective, different artifacts. Personally, when working with NTFS, I'd lean toward ADS for two reasons. 1. The visible file size stays the same. The hidden data exists in an alternate stream rather than the primary file content. 2. The primary file remains intact. The original data stream isn't modified, allowing the file to continue functioning normally while additional data exists alongside it. That's what makes this interesting from a forensic perspective. A file can look completely ordinary in Explorer while containing data that isn't immediately visible. Simple to implement, easy to overlook. Knowing where to look matters just as much as knowing what to look for.

excited to announce that I got an internship at @HSC_Consult. Thank you @h4ruk7 for the opportunity to learn, contribute and work alongside with you. eventually want to see the results of my ambition!

Two weeks ago, I worked on a mobile phone investigation that reminded me of something every digital forensic investigator needs to understand: Sometimes the device cannot answer the question. The phone belonged to a (client's) family member who had died in a foreign country.

One of the most dangerous things an investigator can do is fall in love with their own hypothesis. You see a few artifacts. They seem to point in one direction. A story starts forming. And suddenly, every new finding begins to look like confirmation.

Day 1 and day 2 bug bounty challenge found a race condition but the endpoint it was found doesn’t really have much impact so it was reported Today me and @zoecyber001 carried out a static analysis on a company that reach out to @HSC_Consult for a penetration test Ciao

What if your dispute could be investigated instead of argued? No more “my side vs your side”. Just logs, metadata, timestamps, and a clear chain of custody.

Digital evidence can outlive human memory. People forget. Stories change. Details get fuzzy with time. But servers, devices, and systems keep records. Emails keep headers. Chats keep timestamps. Files keep metadata. Logs keep track of who accessed what, and when.