Seth Enoka – DFIR – Cybersecurity and Technology

A Roadmap to Earning Your First (or Next) SANS Certification

I’m in no way saying that certs or degrees are the only path to success. There are definitely individuals in the field who’ve never taken a cert or completed a degree and are super successful. However, I think those individuals are rare, they’re the exception (i.e. exceptional). In my experience (and it’s only my experience I can speak from), certs are the fastest way to get skilled up in an area where you have knowledge gaps. With that said, let’s get started.

Forensics, Incident Response, Uncategorized |

It can be difficult when there are so many different roles and job titles and little standardisation. The requirements for a role can differ vastly depending on the hiring manager and the HR team (not to call anyone out, it’s a fast moving field and it’s hard to keep up). There’s no shortage of advice like this; I realise of course that a quick Google search brings up a multitude of similar blogs, but if people are still asking ‘where do I start,’ at least having written this I have somewhere to point them for a quick rundown of my thoughts.

Forensics, How-To, Incident Response |

Quick writeup on Alternate Data Streams (ADS). ADS is a file attribute used in NTFS that ultimately provides an opportunity for investigators to extract valuable evidence that might otherwise be overlooked. ADS is an additional stream of data that can be attached to a file on Windows systems. It’s a hidden file attached to a […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

This (for now anyway) will be the last post in this series, in which we’ll add a CentOS 7 x64 workstation to our lab. At this point, the lab looks a little like this: There are some slight nuances to adding a CentOS box to a Windows domain, and we’ll go into greater detail below. […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

By this the fifth instalment of the ‘build your own lab’ series, the lab already resembles this network diagram (or should, anyway): As the title suggests, it’s time to install the Windows 7 workstation(s). Workstation Configuration During the installation, Windows asks for a user name and a Computer Name. Enter these to save a step […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

By this point, part 4 of the series, our lab looks something like this: In this instalment, it’s time to add the Windows 8.1 workstation to the environment. The issue with this ISO, when compared to all the others, is that Windows 8.1 doesn’t allow the OS to be installed without a licence key. As […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

If you haven’t already, complete parts one and two of this guide on building a personal forensics lab in the cloud, which cover creating the Windows Server 2016 primary domain controller (DC), DHCP and DNS server, and the Windows Server 2012 R2 secondary DC. At this point, the lab should look like this: I’ve chosen […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

If you haven’t already completed part one of this series, Creating the Primary Domain Controller, I suggest you visit that page first. If, on the other hand, you have at least the primary DC configured, including DHCP, DNS, and Remote Access (NAT), please continue. At the end of part one, the lab network looked like […]

Forensics, How-To, Incident Response, Network Administration, System Administration |

One of the major things recommended to anyone in digital forensics, and probably network or systems administration as well, is to build a lab in which to test tools, techniques, theories, or anything else one might come up with or across in day-to-day work or personal research. Herein lies part one of a guide on […]

How-To, Network Administration, System Administration |

Recently, a friend made me aware of an alternative to OpenVPN named Wireguard. It’s designed to be extremely lightweight, with a small source code footprint which makes it easily auditable. A whitepaper defining the protocol has been produced and is available for review. Wireguard uses UDP for communication and functions by routing some, or all, […]

Seth Enoka – DFIR

A Roadmap to Earning Your First (or Next) SANS Certification

Unlocking the DFIR Job Market: Strategies for Landing Your Dream Role

Alternate Data Streams

Create a Personal Forensics Lab Part 6: The CentOS Workstation

Create a Personal Forensics Lab Part 5: The Windows 7 Workstations

Create a Personal Forensics Lab Part 4: The Windows 8.1 Workstation

Create a Personal Forensics Lab Part 3: The Windows 10 Workstation

Create a Personal Forensics Lab Part 2: The Secondary Domain Controller

Create a Personal Forensics Lab Part 1: The Primary Domain Controller

Build Your Own Wireguard VPN Server with Pi-Hole for DNS Level Ad Blocking