Sign in

Kevin 🤖🕵️🍺

@stark4n6.bsky.social
951 followers 89 following 379 posts

Lethal forensicator, researcher, developer, blogger, curator of many fine t-shirt designs, resident #DFIR beer drinker startme.stark4n6.com

PostsRepliesMedia
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 28/09/2026
qnxprobe v1.50 recovers deleted files off YAFFS2, JFFS2 and UBIFS flash, opens BitLocker and encrypted APFS with a password, and opens E01, AFF4, .dmg and VMDK directly. leapps.org/probes#section-qnxprobe #DFIR
121
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 27/09/2026
Week 39 - 2026 #DFIR thisweekin4n6.com/2026/09/27/w...
thisweekin4n6.com
Week 39 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Apple Biome Forensics: Artifacts, Locations, a…
021
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 28/09/2026
Digital Forensics Now Podcast - S3 - 8 #DFIR www.youtube.com/live/Ji3bsWj...
youtube.com
Digital Forensics Now Podcast S3 - 8
YouTube video by Alexis Brignoni
010
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 22/09/2026
The Evidence Locker updates: www.linkedin.com/feed/update/...
linkedin.com
The Evidence Locker | Kevin Pagano
The Evidence Locker received some quality of life updates as well as some new evidence! File Search Updates: - Dropdown and text filter on Evidence Source - Tool tip for OS of evidence source and cli...
000
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 21/09/2026
Arc2Lite v3.1.0 update is out today: - Path slash normalization across all reports - Add CSV export option (thanks Dielle De Noon) github.com/stark4n6/Arc...
github.com
Release Arc2Lite v3.1.0 · stark4n6/Arc2Lite
What's Changed Path slash normalization across all reports Add CSV export option by @Gear-I in #4 New Contributors @Gear-I made their first contribution in #4 Full Changelog: v3.0.0...v3.1.0
000
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 18/09/2026
Arc2Lite v3.0.0 has been released, now with support to index E01 and other forensic containers thanks to @abrignoni.com #DFIR github.com/stark4n6/Arc...
github.com
Release Arc2Lite v3.0.0 · stark4n6/Arc2Lite
What's Changed Huge thank you to @abrignoni for adding E01 and forensic container support. Feat/disk image input by @stark4n6 in #3 Full Changelog: v2.0.0...v3.0.0
011
Reposted by Kevin 🤖🕵️🍺
DFIR Diva @dfirdiva.bsky.social · 11/09/2026
The DFIR, OSINT, and Cybersecurity Community Listings site is now live! Find and Submit: - Events - Discounts - Giveaways - New Releases - CFPs - Scholarships - Jobs Submissions are FREE Link: community-listings.dfirdiva.com #DFIR #OSINT #Cybersecurity
community-listings.dfirdiva.com
DFIR, OSINT & Cybersecurity Community Listings
Find and submit Events, New Releases, Discounts, Giveaways, Scholarships, CFPs, and Jobs related to Digital Forensics & Incident Response (DFIR), Open-Source Intelligence (OSINT), and Cybersecurity.
011
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 13/09/2026
Week 37 - 2026 #DFIR thisweekin4n6.com/2026/09/13/w...
thisweekin4n6.com
Week 37 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Corporate Endpoint Triage: How It Works and Wh…
003
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 04/09/2026
#Stark4N6: The Evidence Locker v2 - Now with File Search #DFIR www.stark4n6.com/2026/09/the-...
stark4n6.com
The Evidence Locker v2 - Now with File Search
I've gotten some great feedback and love from the forensics community about The Evidence Locker page. With that said I never settle and I'm...
110
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 02/09/2026
Discord servers getting hit with outages currently, haven't seen that before where they just disappear
000
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 02/09/2026
#Stark4N6: Forensics StartMe Updates (September 2026) #DFIR www.stark4n6.com/2026/09/fore...
stark4n6.com
Forensics StartMe Updates (September 2026)
Shortlink: startme.stark4n6.com QR Code: If people have suggestions for additions please feel free to shoot me a message on the app ...
000
Reposted by Kevin 🤖🕵️🍺
Magnet Forensics @magnetforensics.bsky.social · 01/09/2026
Good news! We've extended the Magnet User Summit & Magnet Virtual Summit 2027 #CallForPapers deadline to Sept 4. Submit your proposal here: ow.ly/vx5050ZHLem Whether it's #AI, #MobileInvestigations, #IncidentResponse, case studies, and more, we want to hear your ideas.
001
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 31/08/2026
#Stark4N6: Pouring Pints - Untappd for Android Analysis #DFIR #MobileForensics #ALEAPP www.stark4n6.com/2026/08/pour...
stark4n6.com
Pouring Pints - Untappd for Android Analysis
Hello fellow socially responsible beer drinkers. I've using the Untappd app for a long time now (3.7k check-ins and counting) but just more ...
010
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 30/08/2026
Week 35 - 2026 #DFIR thisweekin4n6.com/2026/08/30/w...
thisweekin4n6.com
Week 35 – 2026
At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…
001
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 27/08/2026
35% off now on the shop #DFIR #DigitalForensics www.teepublic.com/user/stark4n6
teepublic.com
T-Shirts by stark4n6 | TeePublic
Shop t-shirts, phone cases, hoodies, art prints and mugs created by independent artists from around the globe.
010
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 26/08/2026
The App Is Gone. The Story Isn't. #LEAPPs #DFIR #MobileForensics leapps.org/blog-post?po...
leapps.org
The App Is Gone. The Story Isn't. — LEAPPs Blog
A current app list answers one question. Installation logs, App Store databases, Biome streams, and deletion records answer several others. We went back to an iOS workflow from 2018, tested it from iO...
010
Reposted by Kevin 🤖🕵️🍺
Simson Garfinkel @simson.net · 18/08/2026
bulk_extractor 2.2.0 is out! This release fixes CVE-2026-24857 and adds a standalone 64-bit Windows executable, Windows raw-device input, runtime scanner plug-ins, improved Wi-Fi PCAP preservation, and extensive reliability improvements. github.com/simsong/bulk... #DFIR #DigitalForensics #OpenSource
github.com
Release BE v2.2.0 · simsong/bulk_extractor
What's Changed Update continuous-integration-pip.yml by @simsong in #479 Update identify_filenames.py by @h-ssh in #482 Update LICENSE.md by @simsong in #478 add missing include by @rick-gnous in ...
021
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 16/08/2026
Week 33 - 2026 #DFIR thisweekin4n6.com/2026/08/16/w...
thisweekin4n6.com
Week 33 – 2026
At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…
012
Reposted by Kevin 🤖🕵️🍺
Josh Hickman @thebinaryhick.blog · 16/08/2026
#DFIR
thebinaryhick.blog
Timestamped
Our need will be the real creator. - Plato, The Republic I have been quiet the past few months, but that does not mean I haven't been busy. While working on a larger project I found myself getting really annoyed with timestamps. Because I was working on my Mac, I was having to run out to a website I have used for years for quick timestamp decoding, but I was annoyed with the fact that I was having to do that.
011
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 17/08/2026
#Stark4N6: Tracking Timezone Changes in Digital Wellbeing #DFIR #MobileForensics www.stark4n6.com/2026/08/trac...
stark4n6.com
Tracking Timezone Changes in Digital Wellbeing
In working through some sample evidence during training I came across that Digital Wellbeing, specifically Samsung's iteration of it, tracks...
010
Reposted by Kevin 🤖🕵️🍺
Simson Garfinkel @simson.net · 11/08/2026
#bulk_extractor beta 2.2.0 has been published on github. This version closes more than 100 open issues and improves reliability and performance. Thanks to Codex and Copilot for all of their help. Please give this release a try! #DFIR github.com/simsong/bulk...
github.com
Release BE v2.2.0beta1 · simsong/bulk_extractor
What's Changed Update continuous-integration-pip.yml by @simsong in #479 Update identify_filenames.py by @h-ssh in #482 Update LICENSE.md by @simsong in #478 add missing include by @rick-gnous in ...
001
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 11/08/2026
#Stark4N6: Consensual Forensics with Android Intrusion Logging #DFIR #MobileForensics #ALEAPP www.stark4n6.com/2026/08/cons...
stark4n6.com
Consensual Forensics with Android Intrusion Logging
A few months back Android introduced their new intrusion logging capabilities as part of their advanced protection mode. Security Lab has a ...
000
Reposted by Kevin 🤖🕵️🍺
DEFCONMusic @defconmusicorg.bsky.social · 05/08/2026
. #DEFCON 34 SOUNDTRACK FOR YOUR EARHOLES! The Dark Tangent requested it be released early, shout out to all the producers who donated time and talent! defconcommunications.bandcamp.com #defcon34 #music #hackersummercamp @defcon.bsky.social @defconparrot.bsky.social
defconcommunications.bandcamp.com
DEF CON 34: The Official Soundtrack, by DEF CON Communications
25 track album
122
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 05/08/2026
📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference. ⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence. leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage #DFIR
001
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 03/08/2026
#Stark4N6: Forensics StartMe Updates (August 2026) #DFIR www.stark4n6.com/2026/08/fore...
stark4n6.com
Forensics StartMe Updates (August 2026)
Shortlink: startme.stark4n6.com QR Code: If people have suggestions for additions please feel free to shoot me a message on the app fo...
000
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 02/08/2026
Week 31 - 2026 #DFIR thisweekin4n6.com/2026/08/02/w...
thisweekin4n6.com
Week 31 – 2026
At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…
002
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 30/07/2026
So stoked for this, from a POC to full fledged parsing support for Apple Unified Logs in less than 5 hours!
110
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 28/07/2026
#Stark4N6: Script Stash - Hunting SEGB Streams #DFIR #iOS www.stark4n6.com/2026/07/scri...
stark4n6.com
Script Stash - Hunting SEGB Streams
SEGB Biome streams are the hot replacement for iOS KnowledgeC entries. Mattia Epifani has a great blog on the history including shout out...
010
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 24/07/2026
#Stark4N6: Script Stash - Plist Mapping with Python #DFIR www.stark4n6.com/2026/07/scri...
stark4n6.com
Script Stash - Plist Mapping with Python
Do you do forensic research? Do you have a bunch of random scripts that do one thing to help you along the way? That's precisely what the Sc...
100
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 22/07/2026
New on the LEAPPs blog. ⚙️ astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs
leapps.org
ASTC, Cython, and bugs! — LEAPPs Blog
What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!
012
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 22/07/2026
New files added to The Evidence Locker: 💀💻 Null404 CTF images 📙🧑‍🍳 Packt Publishing / Cody Bounds Digital Forensics Cookbook datasets #DFIR theevidencelocker.github.io
theevidencelocker.github.io
The Evidence Locker
000
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 17/07/2026
A Trip Through the United iOS App #LEAPPs #iLEAPP #DFIR #MobileForensics leapps.org/blog-post?po...
leapps.org
A Trip Through the United iOS App — LEAPPs Blog
A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.
000
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 12/07/2026
Week 28 - 2026 #DFIR thisweekin4n6.com/2026/07/12/w...
thisweekin4n6.com
Week 28 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi…
012
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 12/07/2026
🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR
leapps.org
Artifacts — LEAPPs
Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.
012
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 09/07/2026
Which apps are the LEAPPs NOT parsing? Batch LEAPP's new --coverage mode measures it against real test images and gives you the gaps ranked by evidence. Snapchat: unparsed in 5 of 5 iPhones, 29k files unread. Full write-up: leapps.org/blog-post?po... #DFIR #DigitalForensics #FLOSS #MobileForensics
leapps.org
The Apps We Are Not Parsing (Yet) — LEAPPs Blog
Batch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag...
001
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 05/07/2026
Week 27 - 2026 #DFIR thisweekin4n6.com/2026/07/05/w...
thisweekin4n6.com
Week 27 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage 3 AI Prompts for More Conf…
023
Reposted by Kevin 🤖🕵️🍺
Magnet Forensics @magnetforensics.bsky.social · 02/07/2026
On July 8, join us for our next episode of #MobileUnpacked, where Christopher Vance will explore the how and why behind different Android acquisition methods, including how to get what you need most from Android targets: ow.ly/EWKN50ZjPBe #DFIR
ow.ly
S3:E6 // Aligning on Android acquisitions - Magnet Forensics
How many different ways are there to get Android data? What’s the difference between agent-based extractions and ADB acquisitions?
001
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 28/06/2026
Week 26 - 2026 #DFIR thisweekin4n6.com/2026/06/28/w...
thisweekin4n6.com
Week 26 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts …
001
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 30/06/2026
🚨 Introducing Batch LEAPP. Ever had a folder full of extractions and run them through iLEAPP one at a time? Not anymore. #DFIR Batch LEAPP points at a directory, finds every extraction inside, and runs iLEAPP, ALEAPP, RLEAPP, or VLEAPP on each one. 🔗 Read the post: leapps.org/blog-post?po...
leapps.org
Introducing Batch LEAPP — LEAPPs Blog
Batch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how...
011
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 26/06/2026
Decoding Apple ATX Images in #iLEAPP #DFIR leapps.org/blog-post?po...
leapps.org
Decoding Apple ATX Images in iLEAPP — LEAPPs Blog
Wallpaper research led to a broader Apple image-cache problem: ATX texture files. Here is how iLEAPP now parses and decodes many of them, with a reusable parser that should be easy to port into other ...
000
Reposted by Kevin 🤖🕵️🍺
Phill Moore @phillmoore.bsky.social · 14/06/2026
Week 24 - 2026 #DFIR thisweekin4n6.com/2026/06/14/w...
thisweekin4n6.com
Week 24 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis F-Response F-Response Collect, X-Ways, and You Forensafe…
012
Reposted by Kevin 🤖🕵️🍺
13Cubed @13cubed.bsky.social · 15/06/2026
🎉 A new 13Cubed episode is up! This time we're exploring the USN Journal on a live system. How can we view it while Windows is actively running, and does the reality match the common explanations? Let's find out! www.youtube.com/watch?v=eSLH... #DFIR #DigitalForensics
youtube.com
How the USN Journal Really Works
YouTube video by 13Cubed
011
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 13/06/2026
The dawn of a new era in #DigitalForensics.
021
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 11/06/2026
The only way to confuse facial recognition software 👀
0163
Reposted by Kevin 🤖🕵️🍺
Alexis Brignoni🪫 @abrignoni.com · 21/05/2026
Lots of movement happening in the #LEAPPs project. 🌋 #LAVA (LEAPPs Artifact Viewer App) has been released. 📱 New releases for all the LEAPPs. 🕸️ New webpage with all listed releases by tool. 📧 Mail list available. We won't spam you. 🖋️ Sign up for the mailing list here: www.leapps.org#mailing #DFIR
leapps.org
LEAPPs — Digital Forensics Tools
Free digital forensics tools. iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — parse and visualize artifacts from iOS, Android, Windows, and more.
011
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 19/05/2026
40% off Teepublic stuff now #DFIR www.teepublic.com/user/stark4n6
teepublic.com
T-Shirts by stark4n6 | TeePublic
Shop t-shirts, phone cases, hoodies, art prints and mugs created by independent artists from around the globe.
000
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 20/04/2026
Badge acquired @magnetforensics.bsky.social #MUS2026
011
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 16/04/2026
Did an Amazon return today to Staples, they appeared to still be using iPhones with a home button, wonder if they still get security updates?!
010
Reposted by Kevin 🤖🕵️🍺
Sarah Sweet @sarahsweet.bsky.social · 11/04/2026
NASA failed to predict the real splashdown risk.
Tabby stands on hind legs with one paw outstretched toward a TV displaying a capsule above water.
229163832111
Kevin 🤖🕵️🍺 @stark4n6.bsky.social · 09/04/2026
Today's fortune 🥠
000