My DFIR Blog dfir.ru

Digital Forensics & Incident Response & Reverse Engineering & Vulnerability Research

Windows event logs were cleared, but resurrected in another file!
dfir.ru·16w
Disk encryption: wide-block modes, authentication tags aren’t silver bullets
dfir.ru·54w
Symlink attacks without code execution
dfir.ru·64w
CVE-2025-21210 aka CrashXTS: a practical randomization attack against BitLocker
dfir.ru·69w
Multiple vulnerabilities in AMI file system drivers
dfir.ru·75w
Vulnerabilities in 7-Zip and ntfs3
dfir.ru·100w
Operation-based prefetching
dfir.ru·110w
CVE-2023-4001: a vulnerability in the (downstream) GRUB boot manager
dfir.ru·122w
Bringing unallocated data back: the FAT12/16/32 case
dfir.ru·133w
CVE-2023-45897: a vulnerability in the Linux exFAT userspace tools
dfir.ru·133w
CVE-2023-4692, CVE-2023-4693: vulnerabilities in the GRUB boot manager
dfir.ru·137w

Keyboard Shortcuts

Navigation

Next / previous item
j/k
Open post
oorEnter
Preview post
v

Post Actions

Love post
a
Like post
l
Dislike post
d
Undo reaction
u
Save / unsave
s

Recommendations

Add interest / feed
Enter
Not interested
x

Go to

Home
gh
Interests
gi
Feeds
gf
Likes
gl
History
gy
Changelog
gc
Settings
gs
Browse
gb
Search
/

General

Show this help
?
Submit feedback
!
Close modal / unfocus
Esc

Press ? anytime to show this help