https://thinkdfir.com/2025/12/28/examining-the-iconcache-database/https://thinkdfir.com/wp-content/uploads/2025/12/image-2.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/12/image-1.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/12/image.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/12/screenshot-2025-12-25-163453.pngScreenshot 2025-12-25 1634532025-12-27T23:45:31+00:00monthlyhttps://thinkdfir.com/2025/11/23/a-question-about-arbitrary-values-in-usb-registry-keys/https://thinkdfir.com/wp-content/uploads/2025/11/image-4.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/11/image-3.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/11/image-2.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/11/image-1.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/11/image.pngimage2025-11-23T11:56:40+00:00monthlyhttps://thinkdfir.com/about/2025-11-21T07:04:43+00:00weekly0.6https://thinkdfir.com/resume/2025-11-21T07:04:09+00:00weekly0.6https://thinkdfir.com/2025/07/28/sometimes-windows-and-pe-version-information-dont-get-along/https://thinkdfir.com/wp-content/uploads/2025/07/image-11.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/07/image-10.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/07/image-9.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/07/image-8.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/07/image-7.pngimage2025-07-28T13:29:40+00:00monthlyhttps://thinkdfir.com/find-me/2025-06-29T02:45:26+00:00weekly0.6https://thinkdfir.com/2025/06/13/cached-screenshots-on-windows-11/https://thinkdfir.com/wp-content/uploads/2025/06/image-1.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/06/image.pngimage2025-06-20T17:48:53+00:00monthlyhttps://thinkdfir.com/2025/03/08/sunday-funday-searching-for-searching/https://thinkdfir.com/wp-content/uploads/2025/03/image-22.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-21.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-20.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-19.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-18.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-17.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-16.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-15.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-14.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/03/image-13.pngimage2025-03-08T06:06:17+00:00monthlyhttps://thinkdfir.com/2025/01/13/srumday-funday/https://thinkdfir.com/wp-content/uploads/2025/01/image-11.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-10.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-9.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-8.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-7.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-6.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-5.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-4.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-3.pngimagehttps://thinkdfir.com/wp-content/uploads/2025/01/image-2.pngimage2025-01-13T14:19:02+00:00monthlyhttps://thinkdfir.com/2024/10/31/windows11-wordwheelquery-woes/https://thinkdfir.com/wp-content/uploads/2024/10/image-3.pngimagehttps://thinkdfir.com/wp-content/uploads/2024/10/image-2.pngimagehttps://thinkdfir.com/wp-content/uploads/2024/10/image-1.pngimagehttps://thinkdfir.com/wp-content/uploads/2024/10/image.pngimage2024-10-31T09:45:08+00:00monthlyhttps://thinkdfir.com/2023/11/09/how-can-i-be-of-webassistance/https://thinkdfir.com/wp-content/uploads/2023/11/285b4c55-b9e4-41c2-a559-54e937158abc.png285b4c55-b9e4-41c2-a559-54e937158abc2023-11-09T10:55:38+00:00monthlyhttps://thinkdfir.com/2023/05/17/cpy-jmp/https://thinkdfir.com/wp-content/uploads/2023/05/image-4.pngimage-4https://thinkdfir.com/wp-content/uploads/2023/05/image-3.pngimage-3https://thinkdfir.com/wp-content/uploads/2023/05/image-2.pngimage-2https://thinkdfir.com/wp-content/uploads/2023/05/image-1.pngimage-1https://thinkdfir.com/wp-content/uploads/2023/05/image.pngimage2023-07-20T08:42:50+00:00monthlyhttps://thinkdfir.com/2023/01/13/timestamps-in-indx-entries/https://thinkdfir.com/wp-content/uploads/2023/01/image-8.pngimage-8https://thinkdfir.com/wp-content/uploads/2023/01/image-7.pngimage-7https://thinkdfir.com/wp-content/uploads/2023/01/image-6.pngimage-6https://thinkdfir.com/wp-content/uploads/2023/01/image-5.pngimage-5https://thinkdfir.com/wp-content/uploads/2023/01/image-4.pngimage-4https://thinkdfir.com/wp-content/uploads/2023/01/image-3.pngimage-3https://thinkdfir.com/wp-content/uploads/2023/01/image-2.pngimage-2https://thinkdfir.com/wp-content/uploads/2023/01/image-1.pngimage-1https://thinkdfir.com/wp-content/uploads/2023/01/image.pngimage2023-01-24T08:11:46+00:00monthlyhttps://thinkdfir.com/2022/02/08/tracking-screenshots-with-lnk-files/2022-02-11T00:08:04+00:00monthlyhttps://thinkdfir.com/2022/01/04/i-can-see-and-hear-you-seeing-and-hearing-me/2025-09-02T11:21:26+00:00monthlyhttps://thinkdfir.com/2021/10/24/introducing-awesome-bec/2021-10-24T11:58:05+00:00monthlyhttps://thinkdfir.com/2021/06/03/you-want-me-to-deal-with-how-many-vmdks/2024-05-25T22:21:56+00:00monthlyhttps://thinkdfir.com/2021/02/09/metaspike-ctf-week-6-hodl-onto-your-timestamps/2021-03-06T05:51:33+00:00monthlyhttps://thinkdfir.com/2021/02/01/metaspike-ctf-week-5-spot-the-dfirence/2021-03-06T05:51:17+00:00monthlyhttps://thinkdfir.com/2021/01/16/metaspike-ctf-week-4-im-apparently-making-this-harder-than-it-was-meant-to-be/2021-03-06T05:51:09+00:00monthlyhttps://thinkdfir.com/2021/01/06/metaspike-ctf-week-3-psst-can-you-keep-a-secret-message/2021-10-21T01:16:36+00:00monthlyhttps://thinkdfir.com/2020/12/28/metaspike-ctf-week-2-as-per-my-previous-email/2021-03-06T05:50:46+00:00monthlyhttps://thinkdfir.com/2020/12/21/metaspike-ctf-week-1-its-legit-honest/https://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.41.23-pm.pngScreen Shot 2020-12-14 at 5.41.23 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.41.18-pm.pngScreen Shot 2020-12-14 at 5.41.18 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.40.16-pm.pngScreen Shot 2020-12-14 at 5.40.16 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.38.21-pm.pngScreen Shot 2020-12-14 at 5.38.21 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.38.11-pm.pngScreen Shot 2020-12-14 at 5.38.11 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-5.39.21-pm.pngScreen Shot 2020-12-14 at 5.39.21 pmhttps://thinkdfir.com/wp-content/uploads/2020/12/screen-shot-2020-12-14-at-9.14.52-pm.pngScreen Shot 2020-12-14 at 9.14.52 pm2021-03-06T05:49:52+00:00monthlyhttps://thinkdfir.com/2020/03/09/2020-forensic-4cast-awards-nominations/2020-12-28T11:05:03+00:00monthlyhttps://thinkdfir.com/2020/10/23/when-did-recentapps-go/https://thinkdfir.com/wp-content/uploads/2020/10/winver.pngwinver2020-10-23T06:51:09+00:00monthlyhttps://thinkdfir.com/2020/07/30/certutil-download-artefacts/https://thinkdfir.com/wp-content/uploads/2020/07/cryptnet-strings.pngcryptnet stringshttps://thinkdfir.com/wp-content/uploads/2020/07/cryptnet-content.pngcryptnet content2020-09-12T14:57:26+00:00monthlyhttps://thinkdfir.com/2020/09/07/quick-post-disk-images-for-test-environment/https://thinkdfir.com/wp-content/uploads/2019/02/screen-shot-2020-09-07-at-12.08.22-am.pngScreen Shot 2020-09-07 at 12.08.22 am2020-09-06T14:34:38+00:00monthlyhttps://thinkdfir.com/2018/10/14/clippy-history/https://thinkdfir.com/wp-content/uploads/2018/10/dapi.pngdapihttps://thinkdfir.com/wp-content/uploads/2018/10/stringsearch.pngstringsearchhttps://thinkdfir.com/wp-content/uploads/2018/10/text_pinned_clipboardfolder.pngtext_pinned_clipboardfolderhttps://thinkdfir.com/wp-content/uploads/2018/10/text_metadatajson.pngtext_metadatajsonhttps://thinkdfir.com/wp-content/uploads/2018/10/metadatajson-for-pinned.pngmetadatajson for pinnedhttps://thinkdfir.com/wp-content/uploads/2018/10/2pinneditems.png2pinneditemshttps://thinkdfir.com/wp-content/uploads/2018/10/pinned-text.pngpinned texthttps://thinkdfir.com/wp-content/uploads/2018/10/clipboardsettings.pngclipboardsettingshttps://thinkdfir.com/wp-content/uploads/2018/10/ga96f6iy8hby.jpgga96f6iy8hby2022-05-05T14:54:54+00:00monthlyhttps://thinkdfir.com/2020/04/17/part-of-a-sunday-funday-answer-microsoft-teams/https://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.36.59-pm.pngScreen Shot 2020-04-17 at 12.36.59 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.26.38-pm.pngScreen Shot 2020-04-17 at 12.26.38 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.26.31-pm.pngScreen Shot 2020-04-17 at 12.26.31 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.26.26-pm.pngScreen Shot 2020-04-17 at 12.26.26 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.26.19-pm.pngScreen Shot 2020-04-17 at 12.26.19 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-12.19.43-pm.pngScreen Shot 2020-04-17 at 12.19.43 pmhttps://thinkdfir.com/wp-content/uploads/2020/04/screen-shot-2020-04-17-at-11.58.04-am.pngScreen Shot 2020-04-17 at 11.58.04 am2020-04-17T10:06:25+00:00monthlyhttps://thinkdfir.com/2018/09/15/playing-with-the-ios-powerlog/https://thinkdfir.com/wp-content/uploads/2018/08/2_man-caraves-arsdgdsgnold-schwarzenegger-from-oak1.jpg2_Man-Caraves-Arsdgdsgnold-Schwarzenegger-From-Oakhttps://thinkdfir.com/wp-content/uploads/2018/08/2_man-caraves-arsdgdsgnold-schwarzenegger-from-oak.jpg2_Man-Caraves-Arsdgdsgnold-Schwarzenegger-From-Oak2020-02-10T22:30:15+00:00monthlyhttps://thinkdfir.com/2019/12/27/applocker-ftw/https://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.17.01-pm.pngScreen Shot 2019-12-27 at 10.17.01 pmhttps://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.12.46-pm.pngScreen Shot 2019-12-27 at 10.12.46 pmhttps://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.12.39-pm.pngScreen Shot 2019-12-27 at 10.12.39 pmhttps://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.12.33-pm.pngScreen Shot 2019-12-27 at 10.12.33 pmhttps://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.12.22-pm.pngScreen Shot 2019-12-27 at 10.12.22 pmhttps://thinkdfir.com/wp-content/uploads/2019/12/screen-shot-2019-12-27-at-10.13.23-pm.pngScreen Shot 2019-12-27 at 10.13.23 pm2020-01-19T22:51:32+00:00monthlyhttps://thinkdfir.com/2020/01/16/dfrws-apac-2020/2020-01-16T05:39:06+00:00monthlyhttps://thinkdfir.com/2019/10/05/hunting-for-mac-addresses/https://thinkdfir.com/wp-content/uploads/2019/10/screen-shot-2019-10-05-at-7.21.38-pm.pngScreen Shot 2019-10-05 at 7.21.38 pmhttps://thinkdfir.com/wp-content/uploads/2019/10/screen-shot-2019-10-05-at-7.18.23-pm.pngScreen Shot 2019-10-05 at 7.18.23 pmhttps://thinkdfir.com/wp-content/uploads/2019/10/screen-shot-2019-10-05-at-7.01.05-pm.pngScreen Shot 2019-10-05 at 7.01.05 pm2019-10-24T21:02:17+00:00monthlyhttps://thinkdfir.com/2018/10/07/wintentlm-issues/https://thinkdfir.com/wp-content/uploads/2018/10/screen-shot-2019-10-16-at-11.54.46-am.pngScreen Shot 2019-10-16 at 11.54.46 amhttps://thinkdfir.com/wp-content/uploads/2018/10/capture.pngCapturehttps://thinkdfir.com/wp-content/uploads/2018/10/mimi.pngmimihttps://thinkdfir.com/wp-content/uploads/2018/10/oph.pngoph2019-10-16T03:56:14+00:00monthlyhttps://thinkdfir.com/2019/10/07/playing-with-the-big-chicken-velociraptor-aws-google-domains/https://thinkdfir.com/wp-content/uploads/2019/08/tenor.giftenorhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.46.13-pm.pngScreen Shot 2019-10-07 at 9.46.13 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.45.22-pm.pngScreen Shot 2019-10-07 at 9.45.22 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.45.12-pm.pngScreen Shot 2019-10-07 at 9.45.12 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.45.04-pm.pngScreen Shot 2019-10-07 at 9.45.04 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.44.51-pm.pngScreen Shot 2019-10-07 at 9.44.51 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.44.46-pm.pngScreen Shot 2019-10-07 at 9.44.46 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.44.38-pm.pngScreen Shot 2019-10-07 at 9.44.38 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.44.30-pm.pngScreen Shot 2019-10-07 at 9.44.30 pmhttps://thinkdfir.com/wp-content/uploads/2019/08/screen-shot-2019-10-07-at-9.44.22-pm-e1570445364582.pngScreen Shot 2019-10-07 at 9.44.22 pm2019-10-07T11:16:17+00:00monthlyhttps://thinkdfir.com/win10-joepc-image/2019-08-24T21:33:35+00:00weekly0.6https://thinkdfir.com/2019/07/24/testing-a-usb-write-blocker/https://thinkdfir.com/wp-content/uploads/2019/04/hero-pic.pnghero-pic2019-07-25T04:31:38+00:00monthlyhttps://thinkdfir.com/2019/06/09/ax200-magnet-axiom-examinations-review/https://thinkdfir.com/wp-content/uploads/2019/05/img_20190520_091545-e1560080179395.jpgIMG_20190520_091545.jpghttps://thinkdfir.com/wp-content/uploads/2019/04/ax200.jpgax2002020-12-11T18:15:20+00:00monthlyhttps://thinkdfir.com/2019/05/03/2019-forensic-4cast-awards-nominations/2019-05-04T22:10:38+00:00monthlyhttps://thinkdfir.com/2019/03/21/updating-the-knowledgec-parser/https://thinkdfir.com/wp-content/uploads/2019/03/knowledge-is-power.jpgKnowledge-is-Power2019-03-21T11:44:15+00:00monthlyhttps://thinkdfir.com/2019/03/03/sunday-funday-file-access-on-macos-mojave/https://thinkdfir.com/wp-content/uploads/2019/03/og.pngog2019-03-03T00:29:30+00:00monthlyhttps://thinkdfir.com/2019/02/23/kape-tricks/https://thinkdfir.com/wp-content/uploads/2019/02/preview.pngpreviewhttps://thinkdfir.com/wp-content/uploads/2019/02/tenor.giftenorhttps://thinkdfir.com/wp-content/uploads/2019/02/tenor-1.giftenor (1)2019-03-03T00:05:30+00:00monthlyhttps://thinkdfir.com/2019/02/11/microsoft-office-reading-locations-part-1/https://thinkdfir.com/wp-content/uploads/2019/02/0.1.png0.1https://thinkdfir.com/wp-content/uploads/2019/02/0.pnghttps://thinkdfir.com/wp-content/uploads/2019/02/3.png3https://thinkdfir.com/wp-content/uploads/2019/02/2.png2https://thinkdfir.com/wp-content/uploads/2019/02/1-1.png12019-02-11T08:15:49+00:00monthlyhttps://thinkdfir.com/2019/01/11/what-did-i-listen-to-on-spotify-for-ios/https://thinkdfir.com/wp-content/uploads/2018/11/parse-1.pngparsehttps://thinkdfir.com/wp-content/uploads/2018/11/proto.pngprotohttps://thinkdfir.com/wp-content/uploads/2018/11/decode.jpgdecodehttps://thinkdfir.com/wp-content/uploads/2018/11/filesofinterest1.pngfilesofinterest12019-01-10T21:18:10+00:00monthlyhttps://thinkdfir.com/2017/09/27/playing-with-apfs/https://thinkdfir.com/wp-content/uploads/2017/09/macoshighsierra-800x464.jpgmacoshighsierra-800x464https://thinkdfir.com/wp-content/uploads/2017/09/img_20170927_133611.jpgIMG_20170927_133611https://thinkdfir.com/wp-content/uploads/2017/09/img_20170927_110921.jpgIMG_20170927_110921https://thinkdfir.com/wp-content/uploads/2017/09/xways.pngxwayshttps://thinkdfir.com/wp-content/uploads/2017/09/blacklight.pngblacklighthttps://thinkdfir.com/wp-content/uploads/2017/09/encase8.pngencase82018-12-31T04:31:31+00:00monthlyhttps://thinkdfir.com/2018/11/09/sunday-funday-cutting-across-ntfs-volumes/https://thinkdfir.com/wp-content/uploads/2018/11/cut-up-book2.jpgcut-up-book22018-12-01T11:25:57+00:00monthlyhttps://thinkdfir.com/2018/11/23/quick-post-notes-on-the-win10-recycle-bin/https://thinkdfir.com/wp-content/uploads/2018/11/xxx.pngxxx2018-11-24T23:33:30+00:00monthlyhttps://thinkdfir.com/2018/11/03/sunday-funday-copying-across-ntfs-volumes/https://thinkdfir.com/wp-content/uploads/2018/11/caligraphist.jpgcaligraphist2018-11-04T10:42:44+00:00monthlyhttps://thinkdfir.com/2018/08/28/copying-v-dragging-a-file-to-an-os-x-disk-image/https://thinkdfir.com/wp-content/uploads/2018/08/screen-shot-2018-08-29-at-6-37-33-pm.pngScreen Shot 2018-08-29 at 6.37.33 pmhttps://thinkdfir.com/wp-content/uploads/2018/08/14.png14https://thinkdfir.com/wp-content/uploads/2018/08/13.png13https://thinkdfir.com/wp-content/uploads/2018/08/12.png12https://thinkdfir.com/wp-content/uploads/2018/08/11.png11https://thinkdfir.com/wp-content/uploads/2018/08/10.png10https://thinkdfir.com/wp-content/uploads/2018/08/9.png9https://thinkdfir.com/wp-content/uploads/2018/08/8.png8https://thinkdfir.com/wp-content/uploads/2018/08/7.png7https://thinkdfir.com/wp-content/uploads/2018/08/6.png62018-08-30T08:48:43+00:00monthlyhttps://thinkdfir.com/2018/07/28/should-i-start-a-blog-yes-the-answer-is-yes/https://thinkdfir.com/wp-content/uploads/2018/07/participation_inequality.pngparticipation_inequality2018-08-06T16:39:12+00:00monthlyhttps://thinkdfir.com/presentations/2018-06-24T11:08:21+00:00weekly0.6https://thinkdfir.com/2018/06/17/zone-identifier-kmditemwherefroms/https://thinkdfir.com/wp-content/uploads/2018/06/chrome_ads.pngchrome_adshttps://thinkdfir.com/wp-content/uploads/2018/06/firefox_ads.pngfirefox_adshttps://thinkdfir.com/wp-content/uploads/2018/06/edge_ads.pngedge_adshttps://thinkdfir.com/wp-content/uploads/2018/06/ads13.pngads12018-06-26T19:05:30+00:00monthlyhttps://thinkdfir.com/2018/06/09/speaking-to-google-homes/https://thinkdfir.com/wp-content/uploads/2018/06/homespeak_graphic.pnghomespeak_graphichttps://thinkdfir.com/wp-content/uploads/2018/06/y7r_mcsp.jpgy7r_McsP2018-06-16T10:33:26+00:00monthlyhttps://thinkdfir.com/2018/04/25/my-dfir-conference-tour/2018-04-25T00:26:15+00:00monthlyhttps://thinkdfir.com/2018/03/12/word-document-metadata-bugs-and-verification/https://thinkdfir.com/wp-content/uploads/2018/03/s.pngshttps://thinkdfir.com/wp-content/uploads/2018/03/2metadiver-e1520845858309.png2metadiverhttps://thinkdfir.com/wp-content/uploads/2018/03/1metadiver-e1520845844281.png1metadiverhttps://thinkdfir.com/wp-content/uploads/2018/03/2exif.png2exifhttps://thinkdfir.com/wp-content/uploads/2018/03/1exif.png1exifhttps://thinkdfir.com/wp-content/uploads/2018/03/wc2.pngwc2https://thinkdfir.com/wp-content/uploads/2018/03/wc1.pngwc1https://thinkdfir.com/wp-content/uploads/2018/03/2.png2https://thinkdfir.com/wp-content/uploads/2018/03/1.png12018-03-13T11:11:57+00:00monthlyhttps://thinkdfir.com/2018/01/18/4cast-award-nominations/2018-01-19T01:16:46+00:00monthlyhttps://thinkdfir.com/2017/12/30/documenting-a-week-of-dfir-cookups/https://thinkdfir.com/wp-content/uploads/2017/12/untitled.pnguntitled2018-01-02T02:31:38+00:00monthlyhttps://thinkdfir.com/2017/12/11/things-i-wish-i-knew-before-dfir-netwars/https://thinkdfir.com/wp-content/uploads/2017/12/maxresdefault.jpgmaxresdefault2017-12-12T07:55:50+00:00monthlyhttps://thinkdfir.com/2017/08/18/understanding-orphaned-files/https://thinkdfir.com/wp-content/uploads/2017/08/modification-of-file-record.pngmodification of file recordhttps://thinkdfir.com/wp-content/uploads/2017/08/orphan.pngorphanhttps://thinkdfir.com/wp-content/uploads/2017/08/deleted.pngdeleted2017-12-11T10:54:51+00:00monthlyhttps://thinkdfir.com/2017/09/12/regripper-gui/https://thinkdfir.com/wp-content/uploads/2017/07/rr2.pngrr22017-12-11T10:54:33+00:00monthlyhttps://thinkdfir.com/2017/08/29/google-url-parsing-with-gserpent/https://thinkdfir.com/wp-content/uploads/2017/08/search3.pngsearch3https://thinkdfir.com/wp-content/uploads/2017/08/search2.pngsearch2https://thinkdfir.com/wp-content/uploads/2017/08/search1.pngsearch1https://thinkdfir.com/wp-content/uploads/2017/07/gserpent.pnggserpent2017-12-11T10:54:10+00:00monthlyhttps://thinkdfir.com/2017/10/16/documenting-my-work/2017-12-11T10:53:02+00:00monthlyhttps://thinkdfir.com/2017/07/05/new-blog/2017-08-18T23:36:06+00:00monthlyhttps://thinkdfir.com/contact/2017-07-05T12:15:15+00:00weekly0.6https://thinkdfir.comdaily1.02025-12-27T23:45:31+00:00