https://sethenoka.com/Cybersecurity and TechnologyHugoenMon, 20 Jul 2026 12:00:00 +0000https://sethenoka.com/persistence-artefacts-services-scheduled-tasks-and-intentional-longevity/Mon, 20 Jul 2026 12:00:00 +0000https://sethenoka.com/persistence-artefacts-services-scheduled-tasks-and-intentional-longevity/A DFIR guide to Windows persistence forensics, including services, scheduled tasks, Run keys, autoruns, and what persistence artefacts can and can't prove.https://sethenoka.com/gcfe-vs-gcfa-what-actually-changes/Mon, 13 Jul 2026 20:00:00 +0000https://sethenoka.com/gcfe-vs-gcfa-what-actually-changes/A practical breakdown of what actually changes between GCFE-level and GCFA-level work, including how investigative thinking, scope, and decision-making evolve in real-world DFIR.https://sethenoka.com/shimcache-and-amcache-program-execution-without-certainty/Sun, 14 Jun 2026 18:00:00 +0000https://sethenoka.com/shimcache-and-amcache-program-execution-without-certainty/Windows Shimcache and Amcache forensics guide explaining whether these artefacts prove program execution, what they can show, and how to corroborate execution claims.https://sethenoka.com/prefetch-execution-evidence-and-its-limits/Mon, 11 May 2026 10:00:00 +0000https://sethenoka.com/prefetch-execution-evidence-and-its-limits/Windows Prefetch forensics guide explaining whether Prefetch proves execution, what `.pf` files show, and how Digital Forensics and Incident Response (DFIR) analysts should corroborate Prefetch evidence.https://sethenoka.com/recent-files-jump-lists-and-application-level-context/Mon, 13 Apr 2026 23:00:00 +0000https://sethenoka.com/recent-files-jump-lists-and-application-level-context/This series is deliberately slow. It's trying to build an instinct, not a checklist. In the first article, we framed Windows artefacts as partial, contextual evidence rather than deterministic indicators. In the ShellBags post, we applied that framing to a common mistake: treating shell navigation as proof of file access or intent. ShellBags are a record of what File Explorer remembers about where a user navigated and how those folders were rendered. That's valuable. It's also easy to over-interpret.https://sethenoka.com/soc-analyst-to-incident-responder/Mon, 06 Apr 2026 20:00:00 +0000https://sethenoka.com/soc-analyst-to-incident-responder/What actually changes when moving from SOC analyst to incident responder? A practical breakdown of skills, mindset, and decision-making in real-world DFIR roles.https://sethenoka.com/shellbags-and-user-navigation-what-windows-remembers-about-exploration/Wed, 25 Mar 2026 20:00:00 +0000https://sethenoka.com/shellbags-and-user-navigation-what-windows-remembers-about-exploration/ShellBags forensics guide explaining what Windows ShellBag artefacts record, what they prove about folder navigation, and why they do not prove file access or execution.https://sethenoka.com/windows-recycle-bin-forensics-on-windows-10-and-11/Mon, 16 Feb 2026 22:00:00 +0000https://sethenoka.com/windows-recycle-bin-forensics-on-windows-10-and-11/Windows Recycle Bin forensics guide to $I/$R files, deleted-file metadata, deletion timestamps, and what Recycle Bin artefacts prove on Windows 10 and 11.https://sethenoka.com/understanding-windows-artefacts-as-evidence-not-indicators/Mon, 19 Jan 2026 23:00:00 +0000https://sethenoka.com/understanding-windows-artefacts-as-evidence-not-indicators/Windows forensic artefacts are one of the core evidence sources used in DFIR investigations, but investigations often fail not because analysts cannot extract artefacts, but because they over-interpret them. This article explains how to treat Windows artefacts as evidence, not indicators, and how to reason about them defensibly.https://sethenoka.com/a-roadmap-to-earning-your-first-or-next-sans-certification/Sat, 25 Mar 2023 10:50:00 +0000https://sethenoka.com/a-roadmap-to-earning-your-first-or-next-sans-certification/A practical SANS/GIAC certification roadmap for SOC analysts, incident responders, and DFIR practitioners choosing GSEC, GCIH, GCFE, GCFA, GRID, or SANS Work-Study.https://sethenoka.com/unlocking-the-dfir-job-market-strategies-for-landing-your-dream-role/Sat, 18 Mar 2023 20:54:00 +0000https://sethenoka.com/unlocking-the-dfir-job-market-strategies-for-landing-your-dream-role/It can be difficult when there are so many different roles and job titles and little standardisation. The requirements for a role can differ vastly depending on the hiring manager and the HR team (not to call anyone out, it's a fast moving field and it's hard to keep up). There's no shortage of advice like this; I realise of course that a quick Google search brings up a multitude of similar blogs, but if people are still asking 'where do I start,' at least having written this I have somewhere to point them for a quick rundown of my thoughts.https://sethenoka.com/alternate-data-streams/Sat, 18 Mar 2023 03:38:00 +0000https://sethenoka.com/alternate-data-streams/A practical explanation of NTFS Alternate Data Streams (ADS), why they matter in Windows forensics, how to find them with dir /r, and what investigators should and should not infer.https://sethenoka.com/create-a-personal-forensics-lab-part-6-the-centos-workstation/Fri, 03 May 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-6-the-centos-workstation/This (for now anyway) will be the last post in this series, in which we'll add a CentOS 7 x64 workstation to our lab.https://sethenoka.com/create-a-personal-forensics-lab-part-5-the-windows-7-workstations/Fri, 26 Apr 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-5-the-windows-7-workstations/As the title suggests, it's time to install the Windows 7 workstation(s).https://sethenoka.com/create-a-personal-forensics-lab-part-4-the-windows-8-1-workstation/Fri, 19 Apr 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-4-the-windows-8-1-workstation/In this instalment, it's time to add the Windows 8.1 workstation to the environment. The issue with this ISO when compared to all the others is that Windows 8.1 doesn't allow the OS to be installed without a licence key. As a result, some finagling is required (read: an extra step to get the ISO ready before attempting to install the OS).https://sethenoka.com/create-a-personal-forensics-lab-part-3-the-windows-10-workstation/Fri, 12 Apr 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-3-the-windows-10-workstation/If you haven't already, complete parts one and two of this guide on building a personal forensics lab in the cloud, which cover creating the Windows Server 2016 primary domain controller (DC), DHCP and DNS server, and the Windows Server 2012 R2 secondary DC.https://sethenoka.com/create-a-personal-forensics-lab-part-2-the-secondary-domain-controller/Fri, 05 Apr 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-2-the-secondary-domain-controller/If you haven't already completed part one of this series, Creating the Primary Domain Controller, I suggest you visit that page first. If, on the other hand, you have at least the primary DC configured, including DHCP, DNS, and Remote Access (NAT), please continue.https://sethenoka.com/create-a-personal-forensics-lab-part-1-the-primary-domain-controller/Fri, 29 Mar 2019 08:00:00 +0000https://sethenoka.com/create-a-personal-forensics-lab-part-1-the-primary-domain-controller/One of the major things I recommend to anyone working in DFIR – as well as network or systems administration – is to build a lab in which to test tools, techniques, theories, or anything else you might encounter in day‑to‑day work or personal research. This post is part one of a guide on building a very simple lab in a cloud environment. Readers earlier in their career will probably see more benefit from this series than those near the end, but the principles apply broadly to the industry.https://sethenoka.com/build-your-own-wireguard-vpn-server-with-pi-hole-for-dns-level-ad-blocking/Fri, 22 Mar 2019 08:00:00 +0000https://sethenoka.com/build-your-own-wireguard-vpn-server-with-pi-hole-for-dns-level-ad-blocking/Recently, a friend made me aware of an alternative to OpenVPN named [Wireguard](https://www.wireguard.com). It's designed to be extremely lightweight with a small source code footprint which makes it easily auditable. A whitepaper defining the protocol has been produced and is available [here](https://www.wireguard.com/papers/wireguard.pdf).https://sethenoka.com/build-your-own-forensics-go-bag/Tue, 12 Mar 2019 19:30:00 +0000https://sethenoka.com/build-your-own-forensics-go-bag/Everyone has their own take on the components which make up a basic DFIR go-bag for when that inevitable call from a client comes. I always have a small collection of devices and boot USBs with me which I think are useful in most cases, mostly because I’ve found myself in situations where any of these things would have been really helpful to have at hand. For larger incidents, I’d recommend having a larger case with a few more critical pieces of hardware, but we’ll get to that below.https://sethenoka.com/creating-your-custom-vm/Tue, 15 May 2018 09:06:00 +0000https://sethenoka.com/creating-your-custom-vm/At this point, you've already created your custom Windows ISO and are now ready to use it to deploy a Windows virtual machine on Vultr.https://sethenoka.com/creating-a-custom-windows-iso/Mon, 14 May 2018 10:46:00 +0000https://sethenoka.com/creating-a-custom-windows-iso/In the past, I've had difficulty creating Windows virtual machines with Vultr and other VPS providers that require a custom ISO with the VirtIO drivers. This is a how-to on the process so I can follow it again in the future. Hopefully, others will find this useful as well. This will be the first in a two-part series and will cover creating and uploading the custom ISO. The following post will cover using that ISO to create a VM.