Interested in DFIR? These platforms will help you build practical skills:
• CyberDefenders — https://t.co/PNKnufuDUf
• Blue Team Labs Online — https://t.co/FGFSkJX2z7
• LetsDefend — https://t.co/7WAJB1v5Dp
• TryHackMe — https://t.co/7BBYkTm81A
• SANS DFIR Resources — https://t.co/uyt0H7UvwZ
• Magnet Forensics Training — https://t.co/rRB7RQ4faj
The more investigations you complete, the better you'll become.
This is Windows Event Viewer, and it’s one of the first tools I open during a Windows forensic investigation.
Every time something important happens on a Windows machine, whether it’s a successful login, a failed login attempt, a new process being created, a service starting, or a user accessing a file, there’s a good chance Windows records it here.
In this screenshot, we’re looking at the Security log. Notice the different Event IDs like 4624 (successful logon), 4625 (failed logon), 4688 (process creation), and 4663 (object access). On their own, they don’t tell you much. But when you correlate hundreds of these events, you can reconstruct exactly what happened on a system.
This is why digital forensics isn’t about looking for one suspicious event. It’s about building a timeline from thousands of small events until the full picture starts to make sense.
Here’s my question for you: If you suspected a Windows machine had been compromised, which Event ID would you investigate first, and why?
@Joshuajee0x@EmmiieTLO Even till the end, he wasn't abandoning any of his children. He always took good care of all his children.
His problem was not just being unfaithful, it was womanising.
A night he saw Lindani alone, he started on her. A moment with the HIV lady, he hit.
That's womanising
@Joshuajee0x@EmmiieTLO Yea, I get you.
But, from his earlier days, he was womanising. [So, he probably continued — the case with the woman that gave him HIV]
The ones we all saw were the ones that got pregnant for him.