This blog is a collection of my thoughts in digital forensics and incident response (DFIR) and other cybersecurity related subjects I stumble upon.https://thedfirjournal.com/https://thedfirjournal.com/posts/communicating-uncertainty/https://thedfirjournal.com/posts/communicating-uncertainty/How to communicate forensic findings in a way that enables decisions rather than paralysing them.Sun, 25 Jan 2026 00:00:00 GMThttps://thedfirjournal.com/posts/sharepoint-sync/https://thedfirjournal.com/posts/sharepoint-sync/SharePoint is effectively a file server and Threat Actors love file servers. Your SharePoint is likely a Threat Actors dream.Tue, 11 Mar 2025 00:00:00 GMThttps://thedfirjournal.com/posts/m365-data-exfiltration-rclone/https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/A Business Email Compromise can lead to data exfiltration from entire SharePoint.Sun, 03 Nov 2024 00:00:00 GMThttps://thedfirjournal.com/posts/prefetch-files/https://thedfirjournal.com/posts/prefetch-files/Prefetch files provide significant value to a forensic investigation and may assist in identifying files targeted as part of data extraction, staging and exfiltration.Sat, 01 Feb 2025 00:00:00 GMThttps://thedfirjournal.com/posts/rdp-bitmap-cache/https://thedfirjournal.com/posts/rdp-bitmap-cache/Learn how the RDP Bitmap Cache provides valuable snippets that fill gaps in forensic investigations, revealing Threat Actors activities during RDP sessions.Sun, 01 Dec 2024 00:00:00 GMThttps://thedfirjournal.com/posts/file-carving-encrypted-virtual-disks/https://thedfirjournal.com/posts/file-carving-encrypted-virtual-disks/A significant development in ransomware attacks in recent years is the encryption of virtual hard disks. Is there a way to obtain at least some data out of these encrypted disks?Sat, 04 Jan 2025 00:00:00 GMT