websec
Preserve & verify.
Source → verified copy → artifacts
Document the chain of custody
Digital forensics & incident research
Follow the
evidence.
Reconstruct the incident.
Understand what happened.
Digital evidence. Device artifacts. Incident timelines.
Research at the intersection of forensics, privacy and defense.
EVIDENCE ACQUISITION/ARTIFACT ANALYSIS/INCIDENT RECONSTRUCTION
01 / NEWS & INSIGHTSFROM THE WEBSEC.GR NEWSROOM
THE LATEST PUBLISHED STORIES
News & insights.
Cloud securityStorm-3168: cloud identities at the center of destructive activity
Microsoft's new Azure investigation highlights compromised service principals, credential exposure and the importance of protecting recovery resources.
READ ARTICLE ↗
RansomwareStorm-2570: follow the intrusion, not just the ransomware label
New Microsoft research connects recurring behavior across incidents involving different ransomware families.
READ ARTICLE ↗
Malware analysisMacSync evolves: native macOS modules change the evidence trail
Kaspersky documents a September MacSync infection chain with Objective-C and Swift components, a backdoor module and delivery through disk images.
READ ARTICLE ↗
02 / DIGITAL FORENSICSTHE DISCIPLINE OF FINDING OUT
Evidence first.
The details
make the
difference.
What happened. When it happened. What the evidence can actually support.
01 / HDD
Magnetic media. Mechanical precision.
HDD, SATA SSD, M.2 NVMe and managed flash: different storage architectures, one principle. Preserve the original source.
01 Preserve the source02 Verify integrity03 Correlate the traces04 Explain the findings
03 / THREAT & EVIDENCE MAPCHAPTER 01 / 03
Every connection.
A trail to follow.
01 — The signal
Map the signal.
Establish the scope.
Trace relationships between endpoints, network records and infrastructure. Map what is known, record uncertainty, and preserve context before drawing conclusions.
ScopeTelemetryContext
Explore incident response ↗02 — The acquisition
Preserve the source.
Work from a copy.
Use documented acquisition, verified hashes and a recorded chain of custody. Keep source media separate from analysis and account for the limits of each method.
AcquisitionHash verificationChain of custody
Explore forensic acquisition ↗03 — The reconstruction
Reconstruct events.
Test every inference.
Correlate timestamps, filesystem artifacts and network evidence. Separate observations from interpretation and build a timeline another analyst can examine.
Artifact correlationTimeline analysisReporting
Inside the analysis ↗FOLLOW THE INVESTIGATION ↓
INSIDE THE EVIDENCESCROLL TO EXAMINE / 01—03
LOOK BEYOND THE SURFACE
Every byte.
In context.
The device is the beginning. A defensible finding connects the source, its artifacts and the limits of what they can tell us.
- 01
Preserve the original.
Document the source and the collection boundary.
- 02
Verify the working copy.
Keep integrity checks and the handling record together.
- 03
Reconstruct with context.
Correlate artifacts. Test alternative explanations.
PRESERVE / VERIFY / EXPLAIN
04 / SPECIALIST FOCUSFROM EVIDENCE TO DEFENSE
Forensic rigor.
Defensive depth.
Understand the artifact.
Understand the system that produced it.
01 / DIGITAL FORENSICS↗
Evidence. In context.
Acquisition, device artifacts, evidence integrity and incident reconstruction. Trace the facts and document the limits.
DIGITAL FORENSICS ↗02 / MOBILE↗
A smaller attack surface.
Hardened operating systems. Intentional permissions. Better habits for the device that knows you best.
MOBILE SECURITY ↗03 / COMMUNICATIONS↗
Your keys. Your conversations.
End-to-end encryption, on-prem infrastructure and the endpoint realities behind secure messaging.
SECURE COMMUNICATIONS ↗THE DEFENSE PLAYBOOK
Turn your threat model into a plan.
Prioritise the defenses that fit your reality.
05 / FIELD METHODSREAD. UNDERSTAND. APPLY.
Field methods.
Practical evidence.
All 14 field guides ↗01
mobile / NEW FIELD GUIDE
METHODOLOGY↗02iPhone forensics: from backup to supported finding
mobile / NEW FIELD GUIDE
METHODOLOGY↗03Android forensics: artifacts, profiles and missing data
computer / NEW FIELD GUIDE
METHODOLOGY↗04Windows forensics: build a timeline you can defend
computer / NEW FIELD GUIDE
METHODOLOGY↗05macOS forensics: APFS, logs and application evidence
malware / NEW FIELD GUIDE
METHODOLOGY↗Malware analysis: a careful first examination
THE FORENSIC VIEWING ROOMWATCH / STUDY / PRACTICE
LEARN HOW TO LOOK CLOSER
Expert methods.
Open to everyone.
Six selected videos. Five new field guides. Mobile evidence, computer timelines and a careful first look at suspicious files.
Enter the viewing room ↗ASK BETTER QUESTIONS OF THE EVIDENCE.