Phill Moore @phillmoore.bsky.social · 27/09/2026Week 39 - 2026 #DFIR thisweekin4n6.com/2026/09/27/w...thisweekin4n6.comWeek 39 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Apple Biome Forensics: Artifacts, Locations, a… 021
Phill Moore @phillmoore.bsky.social · 20/09/2026Week 38 - 2026 #DFIR thisweekin4n6.com/2026/09/20/w...thisweekin4n6.comWeek 38 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Eoghan Casey and Francesco Servida at DFRWS Introducing … 021
Phill Moore @phillmoore.bsky.social · 13/09/2026Week 37 - 2026 #DFIR thisweekin4n6.com/2026/09/13/w...thisweekin4n6.comWeek 37 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Corporate Endpoint Triage: How It Works and Wh… 003
Phill Moore @phillmoore.bsky.social · 06/09/2026Week 36 - 2026 #DFIR thisweekin4n6.com/2026/09/06/w...thisweekin4n6.comWeek 36 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis ADF Solutions Finding Evidence After an App Is Deleted A… 001
Phill Moore @phillmoore.bsky.social · 04/09/2026Are we going to stop calling it Amcache?? #DFIR thinkdfir.com/2026/09/04/a...thinkdfir.comAre we going to stop calling it Amcache??I was poking around my system recently and noticed something that’s slightly different with the Amcache folder It looks like C:\windows\appcompat\programs now has a few more files than before! I’ve… 030
Phill Moore @phillmoore.bsky.social · 30/08/2026Week 35 - 2026 #DFIR thisweekin4n6.com/2026/08/30/w...thisweekin4n6.comWeek 35 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a… 001
Phill Moore @phillmoore.bsky.social · 23/08/2026Week 34 - 2026 #DFIR thisweekin4n6.com/2026/08/23/w...thisweekin4n6.comWeek 34 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a… 000
Phill Moore @phillmoore.bsky.social · 16/08/2026Week 33 - 2026 #DFIR thisweekin4n6.com/2026/08/16/w...thisweekin4n6.comWeek 33 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a… 012
Phill Moore @phillmoore.bsky.social · 09/08/2026Week 32 - 2026 #DFIR thisweekin4n6.com/2026/08/09/w...thisweekin4n6.comWeek 32 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a… 001
Phill Moore @phillmoore.bsky.social · 02/08/2026Week 31 - 2026 #DFIR thisweekin4n6.com/2026/08/02/w...thisweekin4n6.comWeek 31 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a… 002
Phill Moore @phillmoore.bsky.social · 26/07/2026Week 30 - 2026 #DFIR thisweekin4n6.com/2026/07/26/w...thisweekin4n6.comWeek 30 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Eoghan Casey at DFRWS Adding Clarity to a Foundational C… 000
Phill Moore @phillmoore.bsky.social · 19/07/2026Week 29 - 2026 #DFIR thisweekin4n6.com/2026/07/19/w...thisweekin4n6.comWeek 29 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts … 000
Phill Moore @phillmoore.bsky.social · 12/07/2026Week 28 - 2026 #DFIR thisweekin4n6.com/2026/07/12/w...thisweekin4n6.comWeek 28 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi… 012
Phill Moore @phillmoore.bsky.social · 05/07/2026Week 27 - 2026 #DFIR thisweekin4n6.com/2026/07/05/w...thisweekin4n6.comWeek 27 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage 3 AI Prompts for More Conf… 023
Phill Moore @phillmoore.bsky.social · 28/06/2026Week 26 - 2026 #DFIR thisweekin4n6.com/2026/06/28/w...thisweekin4n6.comWeek 26 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts … 001
Phill Moore @phillmoore.bsky.social · 21/06/2026Week 25 – 2026 #DFIR thisweekin4n6.com/2026/06/21/w...thisweekin4n6.comWeek 25 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Dr. Neal Krawetz at ‘The Hacker Factor Blog’ TrustMark’s… 000
Phill Moore @phillmoore.bsky.social · 14/06/2026Week 24 - 2026 #DFIR thisweekin4n6.com/2026/06/14/w...thisweekin4n6.comWeek 24 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis F-Response F-Response Collect, X-Ways, and You Forensafe… 012
Phill Moore @phillmoore.bsky.social · 07/06/2026Week 23 - 2026 #DFIR thisweekin4n6.com/2026/06/07/w...thisweekin4n6.comWeek 23 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Emi Polito at Amped How To Investigate Video Evidence: W… 000
Phill Moore @phillmoore.bsky.social · 31/05/2026Week 22 - 2026 #DFIR thisweekin4n6.com/2026/05/31/w...thisweekin4n6.comWeek 22 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage DFIR+AI Primer: How to Com… 000
Phill Moore @phillmoore.bsky.social · 24/05/2026Week 21 - 2026 #DFIR thisweekin4n6.com/2026/05/24/w...thisweekin4n6.comWeek 21 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrea Fortuna PowerShell DFIR 2026: from MemPro… 011
Phill Moore @phillmoore.bsky.social · 17/05/2026Week 20 - 2026 #DFIR thisweekin4n6.com/2026/05/17/w...thisweekin4n6.comWeek 20 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett Why iOS and Android Handle GPS Di… 011
Phill Moore @phillmoore.bsky.social · 10/05/2026Week 19 - 2026 #DFIR thisweekin4n6.com/2026/05/10/w...thisweekin4n6.comWeek 19 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Chad Gish at Magnet Forensics Windows forensics:… 000
Phill Moore @phillmoore.bsky.social · 03/05/2026Week 18 - 2026 #DFIR thisweekin4n6.com/2026/05/03/w...thisweekin4n6.comWeek 18 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett A Digital Forensic View: How iOS … 000
Phill Moore @phillmoore.bsky.social · 26/04/2026Week 17 - 2026 #DFIR thisweekin4n6.com/2026/04/26/w...thisweekin4n6.comWeek 17 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons… 020
Phill Moore @phillmoore.bsky.social · 26/04/2026While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to. We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper thinkdfir.com/2026/04/25/t... #DFIRthinkdfir.comTrust but Verify: Amcache’s OriginalFilename Field Isn’t Always AccurateDuring an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper. Mostly this is a call for help, and an explanation of how to test! TLDR Sometimes AmC… 000
Phill Moore @phillmoore.bsky.social · 19/04/2026Week 16 - 2026 #DFIR thisweekin4n6.com/2026/04/19/w...thisweekin4n6.comWeek 16 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons… 011
Phill Moore @phillmoore.bsky.social · 12/04/2026Week 15 - 2026 #DFIR thisweekin4n6.com/2026/04/12/w...thisweekin4n6.comWeek 15 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons… 010
Phill Moore @phillmoore.bsky.social · 05/04/2026Week 14 - 2026 #DFIR thisweekin4n6.com/2026/04/05/w...thisweekin4n6.comWeek 14 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons… 000
Phill Moore @phillmoore.bsky.social · 29/03/2026Week 13 - 2026 #DFIR thisweekin4n6.com/2026/03/29/w...thisweekin4n6.comWeek 13 – 2026Offline AI—built for DFIRBelkaGPT saves you days of manual review and reporting:- Transcribes audio and video- Describes and classifies pictures- Searches for similar faces- Answers questions about… 033
Phill Moore @phillmoore.bsky.social · 22/03/2026Week 12 - 2026 #DFIR thisweekin4n6.com/2026/03/22/w...thisweekin4n6.comWeek 12 – 2026Mobile Forensics CheatsheetMobile devices track vast amounts of user activity—often a goldmine of forensic evidence:- Device information- Application usage- Bluetooth and Wi-Fi connections- …and ot… 011
Phill Moore @phillmoore.bsky.social · 15/03/2026Week 11 - 2026 #DFIR thisweekin4n6.com/2026/03/15/w...thisweekin4n6.comWeek 11 – 2026Belkasoft X v2.10: More Evidence. Less Manual Effort.- Acquisition support for 40+ new Android devices- Deeper artifact extraction from Discord, Snapchat, iOS Biome, and more- Magnet Axiom (.mfdb) … 011
Phill Moore @phillmoore.bsky.social · 08/03/2026Week 10 - 2026 #DFIR thisweekin4n6.com/2026/03/08/w...thisweekin4n6.comWeek 10 – 2026Try Belkasoft X with BelkaGPT—Free 30-Day TrialOne platform for computer, mobile, cloud, car, and drone forensics.- Support for 1,500+ artifact types out of the box- Advanced tools for data search,… 000
Phill Moore @phillmoore.bsky.social · 01/03/2026Week 09 - 2026 #DFIR thisweekin4n6.com/2026/03/01/w...thisweekin4n6.comWeek 09 – 2026Belkasoft X v2.10 Is Here—With Smarter AI Assistant- BelkaGPT now holds context—ask follow-up questions without restating your query- Import Magnet Axiom (.mfdb) cases directly for AI analysis- Sim… 001
Phill Moore @phillmoore.bsky.social · 22/02/2026Week 08 - 2026 #DFIR thisweekin4n6.com/2026/02/22/w...thisweekin4n6.comWeek 08 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Chamindu PushpikaScattered Spider Uncaged – The AB Projekt Blue Investigation Elcomsoft Pe… 011
Phill Moore @phillmoore.bsky.social · 15/02/2026Week 07 - 2026 #DFIR thisweekin4n6.com/2026/02/15/w...thisweekin4n6.comWeek 07 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Atola TechnologyMaster Your Drives with MultiDrive BerlaEstablishing Occupant Actions & Invo… 001
Phill Moore @phillmoore.bsky.social · 08/02/2026Week 06 - 2026 #DFIR thisweekin4n6.com/2026/02/08/w...thisweekin4n6.comWeek 06 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Chris at AskCleesDecrypting Threema4.db Mike Wilkinson at Cyber TriageConfiguring Your System fo… 021
Phill Moore @phillmoore.bsky.social · 01/02/2026Week 05 - 2026 #DFIR thisweekin4n6.com/2026/02/01/w...thisweekin4n6.comWeek 05 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. BerlaFinding Previous Locations Without Geolocation Data Forensafe Android CoverMe iOS Timezone … 022
Phill Moore @phillmoore.bsky.social · 25/01/2026Week 04 - 2026 #DFIR thisweekin4n6.com/2026/01/25/w...thisweekin4n6.comWeek 04 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Digital Forensics Myanmar Network Action Predictor (Browser Forensic) SSD Recovery, Limitation a… 001
Phill Moore @phillmoore.bsky.social · 18/01/2026Week 03 - 2026 #DFIR thisweekin4n6.com/2026/01/18/w...thisweekin4n6.comWeek 03 – 2026BerlaConnecting Occupants to Vehicles Through Device Data Damien AttoeA Forensic Look at the Grok Android App Oleg Afonin at Elcomsoft Browser Forensics in 2026: App-Bound Encryption and Live Triag… 012
Phill Moore @phillmoore.bsky.social · 11/01/2026Week 02 - 2026 #DFIR thisweekin4n6.com/2026/01/11/w...thisweekin4n6.comWeek 02 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Akash PatelCase Studies: Building Effective Timelines with Plaso (Log2Timeline) Christian Peter“Far over t… 023
Phill Moore @phillmoore.bsky.social · 04/01/2026Week 01 - 2026 #DFIR thisweekin4n6.com/2026/01/04/w...thisweekin4n6.comWeek 01 – 2026Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 022
Phill Moore @phillmoore.bsky.social · 28/12/2025Week 52 - 2025 #DFIR thisweekin4n6.com/2025/12/28/w...thisweekin4n6.comWeek 52 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 011
Phill Moore @phillmoore.bsky.social · 21/12/2025Week 51 - 2025 #DFIR thisweekin4n6.com/2025/12/21/w...thisweekin4n6.comWeek 51 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 000
Phill Moore @phillmoore.bsky.social · 14/12/2025Week 50 - 2025 #DFIR thisweekin4n6.com/2025/12/14/w...thisweekin4n6.comWeek 50 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 021
Phill Moore @phillmoore.bsky.social · 07/12/2025Week 49 - 2025 #DFIR thisweekin4n6.com/2025/12/07/w...thisweekin4n6.comWeek 49 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 011
Phill Moore @phillmoore.bsky.social · 30/11/2025Week 48 - 2025 #DFIR thisweekin4n6.com/2025/11/30/w...thisweekin4n6.comWeek 48 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 023
Phill Moore @phillmoore.bsky.social · 23/11/2025Week 47 - 2025 #DFIR thisweekin4n6.com/2025/11/23/w...thisweekin4n6.comWeek 47 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 000
Phill Moore @phillmoore.bsky.social · 16/11/2025Week 46 - 2025 #DFIR thisweekin4n6.com/2025/11/16/w...thisweekin4n6.comWeek 46 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 000
Phill Moore @phillmoore.bsky.social · 09/11/2025Week 45 - 2025 #DFIR thisweekin4n6.com/2025/11/09/w...thisweekin4n6.comWeek 45 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 000
Phill Moore @phillmoore.bsky.social · 02/11/2025Week 44 – 2025 #DFIR thisweekin4n6.com/2025/11/02/w...thisweekin4n6.comWeek 44 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 012
