Skip to content
  • About
  • Contact
  • Find Me
  • Posts
  • LinkedIn
  • Twitter
  • GitHub
  • This Week In 4n6
Search
Close

ThinkDFIR

random musings on DFIR topics

Resume

I’m not currently looking for more work or projects, but I’m happy to chat with people about things I can help them out with!

Current Projects:

  • ThinkDFIR
  • This Week in 4n6
  • SANS FOR500 and FOR528 Instructor
  • SANS FOR308 course author (retired)
  • Awesome BEC
  • Ruler Project

Share this:

  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
Like Loading...

Recent Posts

  • Examining the IconCache database
  • A question about arbitrary values in USB registry keys
  • Sometimes Windows and PE Version information don’t get along
  • Cached screenshots on Windows 11
  • Sunday Funday – Searching for searching
  • SRUMday Funday!
  • Windows11 Wordwheelquery Woes
  • How can I be of WebAssist(ance)?
  • CPY JMP
  • Timestamps in INDX Entries

Enter your email address to follow this blog and receive notifications of new posts by email.

Archives

logo

RSS SANS Teaching

  • An error has occurred; the feed is probably down. Try again later.

Recent Posts

  • Examining the IconCache database December 28, 2025
  • A question about arbitrary values in USB registry keys November 23, 2025
  • Sometimes Windows and PE Version information don’t get along July 28, 2025
  • Cached screenshots on Windows 11 June 13, 2025
  • Sunday Funday – Searching for searching March 8, 2025
Website Powered by WordPress.com.
Back to top
  • Subscribe Subscribed
    • ThinkDFIR
    • Join 78 other subscribers
    • Already have a WordPress.com account? Log in now.
    • ThinkDFIR
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Copy shortlink
    • Report this content
    • View post in Reader
    • Manage subscriptions
    • Collapse this bar
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy
%d