Arsenal Recon

Developers of digital forensics weapons which include Arsenal Image Mounter, Hibernation Recon, LevelDB Recon, HBIN Recon, & Registry Recon. Arm Yourself! #DFIR

[Arsenal Recon @ArsenalRecon]

Arm yourself with our tools & eliminate blind spots in digital forensics! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Have you thought about how Hibernation Recon could be used to gain new insight into your highest-stakes cold cases? We released a new version (v1.2.3.96) yesterday with significant updates. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR

[Arsenal Recon @ArsenalRecon]

Hibernation Recon has recovered smoking guns in some of the highest-stakes cases involving digital forensics anywhere, ever. Here's a network packet recovered from the third level of a NetWire victim's Windows hibernation slack involving file transfer to an attacker's C2. #DFIR

[Arsenal Recon @ArsenalRecon]

Here's the new Hibernation Recon running on Windows on Arm (WoA) & processing WoA, Windows x64, & Windows x86 hibernation (hiberfil.sys) files! We continue to put extremely powerful & unique functionality in the hands of #DFIR practitioners. Arm yourself! https://t.co/w8v2JqX7rn

[Arsenal Recon @ArsenalRecon]

Here's the new Hibernation Recon (v1.2.3.96) in action! What do you notice about Windows architecture support? Did you know that Hibernation Recon also supports hibernation from Windows XP through the latest build of 11? https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

We just released Hibernation Recon v1.2.3.96 with some awesome updates - Windows 24H2 & 25H2 support, new decompression algorithms, now runs on Windows on Arm & Linux, etc. How do you analyze Windows hibernation? https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Back in the office after sponsoring & exhibiting at the @IACIS 2026 Orlando Training Conference. It was great meeting so many digital forensics practitioners in person! We brought a Neo Geo for students to play towards the end of training... next year we'll have prizes! #DFIR

[Arsenal Recon @ArsenalRecon]

@brockpierson Nightmares from so many wasted hours trying to get this thing to work like a respectable modem.

[Arsenal Recon @ArsenalRecon]

We’re ready for another day at the @IACIS Orlando Training Conference, making more #DFIR practitioners aware of the powerful & unique things our tools can do for them. What’s that under our TV? https://t.co/w8v2JqX7rn

[Arsenal Recon @ArsenalRecon]

Traveling to the @IACIS Orlando Training Conference! Come see us Tue-Th to talk about maximum exploitation of electronic evidence that is not currently possible with other tools & published techniques. Windows swap, hibernation, & more - let's go! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Emina got to the @MassAGO's National Cyber Crime Conference early yesterday to get our classroom setup. We had a mixture of motivated local, state, & federal law enforcement in our workshop "Disks are Gamblers and Virtualization is Vegas." https://t.co/KAzpuzGiYq #DFIR #NCCC2026

[Arsenal Recon @ArsenalRecon]

Getting class materials ready for our "Disks are Gamblers and Virtualization is Vegas" workshop tomorrow at the @MassAGO's National Cyber Crime Conference! Notice anything interesting about this laptop? https://t.co/KAzpuzGiYq #DFIR #NCCC2026

[Arsenal Recon @ArsenalRecon]

Congratulations to Nicholas Smith & Oleksandr Lysyi for completing the Arsenal Image Mounter online training & certification! https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Are you attending the @MassAGO's National Cyber Crime Conference next week? This will be a great opportunity to attend one of our in-person only workshops - Disks are Gamblers and Virtualization is Vegas. #DFIR #NCCC2026

[Arsenal Recon @ArsenalRecon]

Here’s something you don’t see every day in #DFIR - launching a virtual machine from a Linux laptop (safely booted with WinFE) connected to Arsenal Image Mounter across a network via AIM Remote Agent! https://t.co/w8v2JqX7rn

[Arsenal Recon @ArsenalRecon]

Another video of more Linux functionality from the latest Arsenal Image Mounter... this time, creating a forensic image from a physically-attached disk with the AIM Linux CLI. (& yes - slow laptop, slow disk, slow interface in this demonstration. 😂) https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Have you seen Arsenal Image Mounter's latest Linux functionality? Check out the AIM Linux Pro CLI creating a Recon Report from a disk image containing a BitLocker-protected volume and then unlocking & browsing that volume. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

@shanselman @Microsoft Ok, trying to reach Garrett now - thanks! We have another team at MS struggling to get this escalated internally.

[Arsenal Recon @ArsenalRecon]

Now that our "TechHive Scenario" Windows on Arm disk image has been used in a @ChamplainEdu CTF, we think it's time to make it public. Any thoughts on where we should host it? The disk image & associated files are approximately 90gb in size. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Are you an @IACIS member attending the Orlando Training Conference? We'll be there for the first time as a company rather than as students. Come see us May 5-7 to talk about maximum exploitation of electronic evidence & try something fun at our table. #DFIR