Hamdan (@devmuhakeem) header
Hamdan (@devmuhakeem) profile picture

Hamdan

@devmuhakeem

ChemE | WordPress Developer | CMS Expert | Social Media & Community Manager | Open to Remote & Freelance Opportunities | Web3 lover ❤️

 Nigeria, Lagos
muhakeem.hashnode.dev
Joined November 2022
  • Tweets3.4K
  • Following519
  • Followers98
395Media
Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)Photo by Hamdan (@devmuhakeem)
1/ Worked through a forensics lab on file carving. Genuinely different technique from everything else in this series, because it assumes the file system has nothing left to offer at all. Thread below. muhakeem.hashnode.dev/file-c… builder.aws.com/content/3Lk7… github.com/devmuhakeem/SSD-F…
File Carving: Recovering Files That No Longer Have a Name

File Carving: Recovering Files That No Longer Have a Name

Every recovery technique I'd worked through earlier in this forensics series depended on the file system still knowing something about the file in…

muhakeem.hashnode.dev
1
15
more replies
6/ Set up the case with the same documentation discipline as a full disk-image lab: dedicated base directory, examiner details, case number. 7/ Then the part worth planning around: Autopsy eats serious system resources while carving. Lab specifically said not to touch
1
2
8/ Recovered files had generic, auto-generated names, not anything resembling an original filename, because carving has zero access to that information. 9/ Confirmed one carved file actually displayed real, viewable image content, not a corrupted fragment.
1
1/ Every forensic tool I'd worked through up to this point operated on one file at a time: hash a file, check a hash, open a file to verify its format. Worked through a forensics lab using Autopsy to analyze a full Linux disk image. muhakeem.hashnode.dev/analyz…
Analyzing a Disk Image with Autopsy: Reading an Entire File System Without Touching the Original...

Analyzing a Disk Image with Autopsy: Reading an Entire File System Without Touching the Original...

Every forensic tool I'd worked through up to this point operated on one file at a time: hash a file, check a hash, open a file to verify its format. This…

muhakeem.hashnode.dev
1
16
more replies
6/ The Results tab went further, automatically flagged the file as password protected. A real finding surfaced without me manually opening and testing it myself. 7/ There's also a dedicated Images/Videos gallery that pulls every media file across the whole image into one view
1
1
8/ At the scale of a real disk image with potentially thousands of files, that kind of automatic categorization is what makes systematic review practical instead of just theoretically possible builder.aws.com/content/3Lh3… github.com/devmuhakeem/Analy…
Analyzing a Disk Image with Autopsy: Reading an Entire File System Without Touching the Original...

Analyzing a Disk Image with Autopsy: Reading an Entire File System Without Touching the Original...

This lab moved to a different scale entirely, taking a complete disk image, a full forensic copy of a Linux system's hard disk, and loading it into Autopsy, a dedicated forensic analysis platform, to...

builder.aws.com
1
1/ Worked through a forensics lab on viewing files of different formats. Real lesson: recognizing when a tool's failure IS the evidence, not a dead end. Thread below. muhakeem.hashnode.dev/a-blan… builder.aws.com/content/3LgC… github.com/devmuhakeem/Viewi…
A Blank Screen Is a Finding: Viewing File Formats for Forensic Clues

A Blank Screen Is a Finding: Viewing File Formats for Forensic Clues

An attacker trying to sneak a file past a network administrator doesn't need sophisticated malware if a simpler trick works just as well: rename the file…

muhakeem.hashnode.dev
1
14
more replies
7/ Easy to treat that as "tool's broken, move on." The lab framed it as the opposite: the failure IS the finding. A working file needs no further attention. A file that fails to open as claimed is exactly the signal worth flagging.
1
2
8/ Actually determining what the file really is comes later in a deeper module. This lab's job was the essential first step: noticing the mismatch exists at all.
1
Load more