DFIR · EVIDENCE
Digital Forensics & Investigations
Evidence-grade investigations of compromised hosts, phishing, insider cases and data leaks — with a clear, defensible timeline.
5
Deliverables
9
Tools
3
Attacks covered
What I deliver
- Memory and disk acquisition with hashing and chain of custody
- Windows and Linux artefact analysis
- Email, phishing and header investigations
- Timeline reconstruction across hosts and logs
- Reports written for management, legal and technical teams
⟩ how I approach it
Step by step
- 01
Isolate, don't wipe — preserve evidence
- 02
Capture memory, then disk, with hashes
- 03
Analyse artefacts and logs
- 04
Build the timeline of what happened
- 05
Report for management, legal and IT
⟩ who it's for
Companies after a breach or suspicious activityHR / legal investigationsPhishing and account-takeover victimsInsurers needing an independent view
⟩ real-world projects
Selected engagements
From my work at BERRY9 IT Services, as a freelancer, at CRIS InfoTech and Hacktr Technologies, and my own tools and research.
01
Phishing investigations — campaigns, malicious URLs and email headers traced to their source
02
Root cause analysis for client incidents with long-term preventive actions
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
- STEP 1Trace the email: headers, SPF/DKIM/DMARC, links
- STEP 2Find who clicked and entered credentials (proxy, IdP logs)
- STEP 3Check for follow-on logins and mailbox rules
- STEP 4Contain: reset, revoke sessions, block sender
⟩ arsenal
Tools & frameworks
Volatility
Memory Forensics
Autopsy
Disk Forensics
KAPE
Triage Collection
FTK Imager
Disk Imaging
Velociraptor
DFIR Platform
Sysinternals
Windows Diagnostics
Wireshark
Packet Analysis
Sysmon
Windows Telemetry
CyberChef
Decode & Transform
⟩ engage
Need digital forensics & investigations expertise?
⟩ related
More in Specialized Expertise
VAPT & WAPT
6+ years leading 100+ real-world projects, identifying critical vulnerabilities in complex enterprise networks and web applications.
SOC Operations
6+ years managing L1/L2/L3 SOC operations for numerous clients, detecting and responding to advanced threats in real-time.
AI Agent Security
Security reviews of AI agents that call tools, browse, read documents and take actions — where prompt injection becomes real-world impact.
Mobile & API Security
6+ years of deep-dive mobile testing for 100+ iOS/Android apps, uncovering critical vulnerabilities.
Malware Analysis & Threat Intelligence
6+ years reverse-engineering real-world malware and producing actionable threat intelligence — YARA/Sigma rules, IOC feeds and MITRE ATT&CK-mapped reports that ship straight into client SOCs.