Yogesh Khatri

DFIR R&D guy

[Yogesh Khatri @SwiftForensics]

mac_apt v0.6 is now available. Big new features-
🔐Encrypted APFS images supported
🔓T2 APFS AFF4 images supported
⏳FAST mode for quick results!
https://t.co/uPH3gTIbJH
#DFIR #mac4n6

[Phill Moore @phillmoore]

Are we going to stop calling it Amcache?? #DFIR

https://t.co/UurCcXkuvJ

[Massimiliano Dal Cero @mdalcero]

DRIFT Linux is born🐧

A #Linux distro built for #DigitalForensics & #IncidentResponse (#DFIR): a portable lab for device and disk acquisition, Web/Cloud evidence collection, and early stages of incident analysis.
https://t.co/Uti7psO2MY

#linux #cybersecurity #forensics #cyber

[John Hammond @_JohnHammond]

Video demo of the NTUSER dot MAN trick I saw floating around before the new year -- I did not know this was a thing👀 Hat tip to DeceptIQ et al.... we showcase:

1. breaking a Windows login with an empty user profile,
2. getting initial access EZPZ with a Sliver C2 implant,
3. exporting, downloading, and hijacking an existing target user profile NTUSER.DAT or HKCU Registry hive,
4. converting hives from .reg plaintext to binary with the HiveSwarming.exe tool,
5. and establishing persistence with the new backdoored NTUSER dot MAN profile we upload!

No Registry writes, API calls or registry callbacks because it's just a single file placed on disk! Kinda neat.

This is my first recording after a month break for the holidays and it was _painful_ -- lots of fails and mistakes and it took many hours 😅

I'm experimenting with MEMES in the THUMBNAIL and SHORT video TITLES to MITIGATE against CLICKBAIT

Also experimenting with longer social text promos for video releases to add more preview details and context. I no longer have to just feed algorithms, but now LLMs, too!

Feels good to get something out the door again. I hope you take a look! YouTube link: https://t.co/z2mQ0m5rzq

[Willi Ballenthin @williballenthin]

QUANTUMSTRAND beta 1 released: built for analysts to quickly understand *where* strings are, *what* they might be, and *how* important they are, without getting lost in a sea of undifferentiated text.

Thanks @m_r_tz and the crew at @Mandiant FLARE

https://t.co/IKMi5fNM13

[Minoru Kobayashi @unkn0wnbit]

🛠️ FJTA update released (2025-08-18)!

Changes include:
✅ No longer requires TSK 4.13.0 for XFS recognition
✅ Minor code refactoring

🔗 https://t.co/V87LraLh0L
#DFIR #Linux

[Yogesh Khatri @SwiftForensics]

mac_apt v1.26.1 is here, now supports processing Velociraptor collections and compiled versions for macOS too. Many incremental updates and new plugins (we are at 52 plugins now!).
https://t.co/FB2icmZ5PZ #DFIR #macOS

[Minoru Kobayashi @unkn0wnbit]

🛠️ FJTA update released (2025-07-29)!

Changes include:
✅ Improved parsing of XFS journal log records
✅ Enhanced handling of directory entries (ext4/XFS)
✅ Minor bug fixes

🔗 https://t.co/V87LraLh0L
#DFIR #Linux

[Phorion @PhorionTech]

Introducing Phorion. A modern EDR platform purpose-built for macOS.
Because security teams shouldn’t have to settle for Windows-first tools. 🛡️🍎
🧵

[Yogesh Khatri @SwiftForensics]

Found an interesting location storing wifi connect/disconnect information on #macos
#DFIR
https://t.co/RhB3ejH4mP

[Minoru Kobayashi @unkn0wnbit]

Hi, #DFIR guys,
I am developing a new forensic tool for parsing journal data of #Linux filesystems (not systemd journal logs).
It can not only parse filesystem journals but also generate timeline events for DFIR.
This tool currently supports only EXT4, but I plan to add support for XFS as well.
Additionally, it can detect suspicious activities such as timestomping.
The tool is still incomplete, so it will take at least a few more weeks before the first release.

[Brian Maloney @bmmaloney97]

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR

https://t.co/fMJhCCBWs5

[Yogesh Khatri @SwiftForensics]

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

[13Cubed @13CubedDFIR]

Happy New Year! 🎉🥳 The first 13Cubed episode of 2025 is here! Let's explore some groundbreaking research from CyberCX on “rewinding the NTFS USN Journal.” https://t.co/I58MqTkg8n #DFIR

[Yogesh Khatri @SwiftForensics]

@gpresman @chadtilbury @antoniosanzalc Sorry about that, silly corp policy on geo blocking. Try this:
https://t.co/xqhJUR8aIb

[Yogesh Khatri @SwiftForensics]

@GalloDu link to code https://t.co/8GXpjMspCk

[Yogesh Khatri @SwiftForensics]

If you've had this problem (see pic), NTFS Journal REWIND solves it! . New blog post + code. No more unknown paths.
https://t.co/I168CB7IGL
#NTFS #DFIR

[Yogesh Khatri @SwiftForensics]

@GalloDu Sorry not sure why your location is blocked on corp website. Try this
https://t.co/xqhJUR8IxJ

[Yogesh Khatri @SwiftForensics]

@Songrongn @KevinPagano3 No idea, but it does sometimes. Also, forgot to mention, I wrote a Velociraptor artifact to pull this information out.
https://t.co/qSJV74Ifx3

https://t.co/GfbjlvCNkv

[Yogesh Khatri @SwiftForensics]

Windows Thumbnail caches are a mostly unused artifact. Did you know they can point to paths on external systems? (Yes path embedded in thumbcache file, not from win search db) Can be helpful when threat actors actively delete logs and other artifacts! #DFIR

[Yogesh Khatri @SwiftForensics]

@unkn0wnbit Thanks for updating mac_apt.

[Yogesh Khatri @SwiftForensics]

🆕 mac_apt release v1.5.8
New modules, macOS 13 & RSR support, Python 3.10 compatibility, easier installation, bug fixes
https://t.co/QVe9Y3fX96
#DFIR #macOS