41554 blogs · [ { "id": "01a0876c-4b31-72bb-9c42-bf1307bdfdf3", "title": "Two conference talks (slides)", "url": "https://dfir.ru/2026/09/09/two-conference-talks-slides/", "published_at": "2026-09-09T15:35:14+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf1308232c30", "title": "Mark-of-the-Web: the rules changed, the tools didn’t", "url": "https://dfir.ru/2026/06/29/mark-of-the-web-the-rules-changed-the-tools-didnt/", "published_at": "2026-06-29T20:31:48+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130861d650", "title": "Windows event logs were cleared, but resurrected in another file!", "url": "https://dfir.ru/2026/01/26/windows-event-logs-were-cleared-but-resurrected-in-another-file/", "published_at": "2026-01-26T17:08:19+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130878bf1c", "title": "Disk encryption: wide-block modes, authentication tags aren’t silver bullets", "url": "https://dfir.ru/2025/05/08/disk-encryption-wide-block-modes-authentication-tags-arent-silver-bullets/", "published_at": "2025-05-08T18:00:00+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf1309552ac1", "title": "Symlink attacks without code execution", "url": "https://dfir.ru/2025/02/23/symlink-attacks-without-code-execution/", "published_at": "2025-02-23T17:08:12+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf1309f152f5", "title": "CVE-2025-21210 aka CrashXTS: a practical randomization attack against BitLocker", "url": "https://dfir.ru/2025/01/20/cve-2025-21210-aka-crashxts-a-practical-randomization-attack-against-bitlocker/", "published_at": "2025-01-20T17:29:51+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130a99d097", "title": "Multiple vulnerabilities in AMI file system drivers", "url": "https://dfir.ru/2024/12/09/multiple-vulnerabilities-in-ami-file-system-drivers/", "published_at": "2024-12-09T16:09:48+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130b772f7e", "title": "Vulnerabilities in 7-Zip and ntfs3", "url": "https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/", "published_at": "2024-06-18T22:20:29+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130bf1a0b5", "title": "Operation-based prefetching", "url": "https://dfir.ru/2024/04/09/operation-based-prefetching/", "published_at": "2024-04-08T22:13:18+00:00" }, { "id": "01a0876c-4b31-72bb-9c42-bf130bfcdc6a", "title": "CVE-2023-4001: a vulnerability in the (downstream) GRUB boot manager", "url": "https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/", "published_at": "2024-01-15T07:58:11+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295bdbfd0c", "title": "Bringing unallocated data back: the FAT12/16/32 case", "url": "https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case/", "published_at": "2023-11-01T20:50:07+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295c4348c2", "title": "CVE-2023-45897: a vulnerability in the Linux exFAT userspace tools", "url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/", "published_at": "2023-11-01T12:08:58+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295cf99eac", "title": "CVE-2023-4692, CVE-2023-4693: vulnerabilities in the GRUB boot manager", "url": "https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/", "published_at": "2023-10-03T19:28:36+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295dbd7d25", "title": "CVE-2023-4273: a vulnerability in the Linux exFAT driver", "url": "https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/", "published_at": "2023-08-23T19:55:36+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295e5c4142", "title": "Do researchers handle exFAT volumes correctly?", "url": "https://dfir.ru/2022/12/18/do-researchers-handle-exfat-volumes-correctly/", "published_at": "2022-12-18T19:55:41+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295f3e8753", "title": "exFAT: orphan file name entries", "url": "https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/", "published_at": "2022-02-11T00:27:22+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa295ff6ff02", "title": "macOS & FAT directories", "url": "https://dfir.ru/2022/01/15/macos-fat-directories/", "published_at": "2022-01-14T23:24:08+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa296021409a", "title": "Things you probably didn’t know about FAT", "url": "https://dfir.ru/2021/12/08/things-you-probably-didnt-know-about-fat/", "published_at": "2021-12-08T15:40:08+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa29603e2b0e", "title": "The uppercased hell", "url": "https://dfir.ru/2021/10/15/the-uppercased-hell/", "published_at": "2021-10-14T23:30:01+00:00" }, { "id": "01a0c507-d57a-7023-93fb-aa29611794e3", "title": "Playing with case-insensitive file names", "url": "https://dfir.ru/2021/07/15/playing-with-case-insensitive-file-names/", "published_at": "2021-07-15T10:21:20+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00a5f0dfd", "title": "Shadow copies become less visible", "url": "https://dfir.ru/2021/06/28/shadow-copies-become-less-visible/", "published_at": "2021-06-28T15:40:11+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00b2c5139", "title": "$STANDARD_INFORMATION vs. $FILE_NAME", "url": "https://dfir.ru/2021/01/10/standard_information-vs-file_name/", "published_at": "2021-01-09T22:25:37+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00b46872b", "title": "The NT kernel can ignore your hardware clock during the boot", "url": "https://dfir.ru/2020/10/25/the-nt-kernel-can-ignore-your-hardware-clock-during-the-boot/", "published_at": "2020-10-25T15:25:18+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00c01f81e", "title": "Exporting registry hives from a live system", "url": "https://dfir.ru/2020/10/03/exporting-registry-hives-from-a-live-system/", "published_at": "2020-10-03T13:28:46+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00c52b314", "title": "Containerized registry hives in Windows", "url": "https://dfir.ru/2020/08/15/containerized-registry-hives-in-windows/", "published_at": "2020-08-15T14:02:43+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00c7aafda", "title": "Offline shadow copies", "url": "https://dfir.ru/2020/07/14/offline-shadow-copies/", "published_at": "2020-07-14T09:03:21+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00d6971e9", "title": "Storage Reserve blocks some tools from thoroughly wiping unallocated space", "url": "https://dfir.ru/2020/06/29/storage-reserve-blocks-some-tools-from-thoroughly-wiping-unallocated-space/", "published_at": "2020-06-28T23:34:50+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00df3f74c", "title": "Extracting unallocated clusters from a shadow copy", "url": "https://dfir.ru/2020/06/21/extracting-unallocated-clusters-from-a-shadow-copy/", "published_at": "2020-06-21T13:05:56+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00ee6599d", "title": "Trim and unallocated space", "url": "https://dfir.ru/2020/06/12/trim-and-unallocated-space/", "published_at": "2020-06-11T23:45:00+00:00" }, { "id": "01a0c518-88d0-7030-8c3e-75f00f2bb32f", "title": "OneDrive and NTFS last access timestamps", "url": "https://dfir.ru/2020/05/23/onedrive-and-ntfs-last-access-timestamps/", "published_at": "2020-05-22T23:43:59+00:00" }, { "id": "01a0c523-865e-7221-b469-86af79126f2d", "title": "Deceptive NTFS short file names", "url": "https://dfir.ru/2020/05/18/deceptive-ntfs-short-file-names/", "published_at": "2020-05-17T23:19:47+00:00" }, { "id": "01a0c523-865e-7221-b469-86af79e71634", "title": "Prepopulated artifacts", "url": "https://dfir.ru/2020/05/06/prepopulated-artifacts/", "published_at": "2020-05-06T20:57:03+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7a0c2270", "title": "BAM internals", "url": "https://dfir.ru/2020/04/08/bam-internals/", "published_at": "2020-04-08T00:05:02+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7a100555", "title": "The “\\$Extend\\$Deleted” directory", "url": "https://dfir.ru/2020/03/21/the-extenddeleted-directory/", "published_at": "2020-03-21T17:59:27+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7a68ace5", "title": "Scoped shadow copies", "url": "https://dfir.ru/2020/02/29/scoped-shadow-copies/", "published_at": "2020-02-29T17:00:47+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7b137e7c", "title": "You write to a logical drive when you read from it", "url": "https://dfir.ru/2020/02/23/you-write-to-a-logical-drive-when-you-read-from-it/", "published_at": "2020-02-23T01:15:52+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7bb44d17", "title": "Carving file control blocks from memory dumps", "url": "https://dfir.ru/2020/02/09/carving-file-control-blocks-from-memory-dumps/", "published_at": "2020-02-09T13:04:27+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7c9f5fe4", "title": "Windows forensics: open research topics", "url": "https://dfir.ru/2019/08/27/windows-forensics-open-research-topics/", "published_at": "2019-08-27T09:41:25+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7ce008e7", "title": "Things you probably didn’t know about shadow copies", "url": "https://dfir.ru/2019/07/29/things-you-probably-didnt-know-about-shadow-copies/", "published_at": "2019-07-28T23:20:07+00:00" }, { "id": "01a0c523-865e-7221-b469-86af7d002636", "title": "NTFS: large clusters", "url": "https://dfir.ru/2019/04/23/ntfs-large-clusters/", "published_at": "2019-04-23T18:16:42+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d615ef62c0", "title": "Forensic analysis of disclosed uninitialized kernel memory", "url": "https://dfir.ru/2019/03/25/forensic-analysis-of-disclosed-uninitialized-kernel-memory/", "published_at": "2019-03-24T23:37:07+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d616093784", "title": "NTFS: unallocated data marked as allocated", "url": "https://dfir.ru/2019/02/28/ntfs-unallocated-data-marked-as-allocated/", "published_at": "2019-02-28T19:52:41+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d61677608a", "title": "How the $LogFile works?", "url": "https://dfir.ru/2019/02/16/how-the-logfile-works/", "published_at": "2019-02-16T14:23:46+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d6168d6fa2", "title": "NTFS today", "url": "https://dfir.ru/2019/01/19/ntfs-today/", "published_at": "2019-01-19T01:38:30+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d6173a2852", "title": "Hibernation and NTFS", "url": "https://dfir.ru/2019/01/08/hibernation-and-ntfs/", "published_at": "2019-01-08T00:58:40+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d6179fa574", "title": "What writes to the Syscache hive?", "url": "https://dfir.ru/2019/01/04/what-writes-to-the-syscache-hive/", "published_at": "2019-01-04T00:17:57+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d617c18c10", "title": "The (in)consistency of last access timestamps", "url": "https://dfir.ru/2018/12/16/the-inconsistency-of-last-access-timestamps/", "published_at": "2018-12-15T21:34:16+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d617c87dcd", "title": "The “Last Access” updates are almost back", "url": "https://dfir.ru/2018/12/08/the-last-access-updates-are-almost-back/", "published_at": "2018-12-08T00:58:51+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d618698df9", "title": "The CIT database and the Syscache hive", "url": "https://dfir.ru/2018/12/02/the-cit-database-and-the-syscache-hive/", "published_at": "2018-12-01T21:39:30+00:00" }, { "id": "01a0c52f-051a-71f0-8340-63d6189da2a0", "title": "Exploring intermediate states of a registry hive using transaction log files", "url": "https://dfir.ru/2018/11/19/exploring-intermediate-states-of-a-registry-hive-using-transaction-log-files/", "published_at": "2018-11-19T01:17:27+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b8586deac4", "title": "Tools that recover deleted registry data don’t do the same job", "url": "https://dfir.ru/2018/11/18/tools-that-recover-deleted-registry-data-dont-do-the-same-job/", "published_at": "2018-11-17T21:30:28+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b85899a127", "title": "Effects of running an offline AV scan", "url": "https://dfir.ru/2018/10/26/effects-of-running-an-offline-av-scan/", "published_at": "2018-10-25T23:41:30+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b8591a8d6b", "title": "Hiding data in the registry", "url": "https://dfir.ru/2018/10/07/hiding-data-in-the-registry/", "published_at": "2018-10-06T23:10:19+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b85a012ac4", "title": "Memory compression and forensics", "url": "https://dfir.ru/2018/09/08/memory-compression-and-forensics/", "published_at": "2018-09-08T00:44:03+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b85aaf070e", "title": "A live forensic distribution writing to a suspect drive", "url": "https://dfir.ru/2018/07/25/a-live-forensic-distribution-writing-to-a-suspect-drive/", "published_at": "2018-07-25T00:26:21+00:00" }, { "id": "01a0c539-80df-73a4-9cb0-67b85b51e269", "title": "A live forensic distribution executing malicious code from a suspect drive", "url": "https://dfir.ru/2018/07/21/a-live-forensic-distribution-executing-malicious-code-from-a-suspect-drive/", "published_at": "2018-07-21T00:20:39+00:00" } ] posts Claim your blog

Back to dfir.ru

Blog · corpus.blog/blogs/dfir.ru/posts

dfir.ru

dfir.ru

2026

Two conference talks (slides)original ↗

9 Sept 2026

Mark-of-the-Web: the rules changed, the tools didn’t original ↗

29 Jun 2026

Windows event logs were cleared, but resurrected in another file!original ↗

26 Jan 2026

2025

Disk encryption: wide-block modes, authentication tags aren’t silver bullets original ↗

8 May 2025

Symlink attacks without code execution original ↗

23 Feb 2025

CVE-2025-21210 aka CrashXTS: a practical randomization attack against BitLocker original ↗

20 Jan 2025

2024

Multiple vulnerabilities in AMI file system drivers original ↗

9 Dec 2024

Vulnerabilities in 7-Zip and ntfs3 original ↗

18 Jun 2024

Operation-based prefetching original ↗

8 Apr 2024

CVE-2023-4001: a vulnerability in the (downstream) GRUB boot manager original ↗

15 Jan 2024

2023

Bringing unallocated data back: the FAT12/16/32 case original ↗

1 Nov 2023

CVE-2023-45897: a vulnerability in the Linux exFAT userspace tools original ↗

1 Nov 2023

CVE-2023-4692, CVE-2023-4693: vulnerabilities in the GRUB boot manager original ↗

3 Oct 2023

CVE-2023-4273: a vulnerability in the Linux exFAT driver original ↗

23 Aug 2023

2022

Do researchers handle exFAT volumes correctly?original ↗

18 Dec 2022

exFAT: orphan file name entries original ↗

11 Feb 2022

macOS & FAT directories original ↗

14 Jan 2022

2021

Things you probably didn’t know about FAT original ↗

8 Dec 2021

The uppercased hell original ↗

14 Oct 2021

Playing with case-insensitive file names original ↗

15 Jul 2021

Shadow copies become less visible original ↗

28 Jun 2021

$STANDARD_INFORMATION vs. $FILE_NAME original ↗

9 Jan 2021

2020

The NT kernel can ignore your hardware clock during the boot original ↗

25 Oct 2020

Exporting registry hives from a live system original ↗

3 Oct 2020

Containerized registry hives in Windows original ↗

15 Aug 2020

Offline shadow copies original ↗

14 Jul 2020

Storage Reserve blocks some tools from thoroughly wiping unallocated space original ↗

28 Jun 2020

Extracting unallocated clusters from a shadow copy original ↗

21 Jun 2020

Trim and unallocated space original ↗

11 Jun 2020

OneDrive and NTFS last access timestamps original ↗

22 May 2020

Deceptive NTFS short file names original ↗

17 May 2020

Prepopulated artifacts original ↗

6 May 2020

BAM internals original ↗

8 Apr 2020

The “\$Extend\$Deleted” directory original ↗

21 Mar 2020

Scoped shadow copies original ↗

29 Feb 2020

You write to a logical drive when you read from it original ↗

23 Feb 2020

Carving file control blocks from memory dumps original ↗

9 Feb 2020

2019

Windows forensics: open research topics original ↗

27 Aug 2019

Things you probably didn’t know about shadow copies original ↗

28 Jul 2019

NTFS: large clusters original ↗

23 Apr 2019

Forensic analysis of disclosed uninitialized kernel memory original ↗

24 Mar 2019

NTFS: unallocated data marked as allocated original ↗

28 Feb 2019

How the $LogFile works?original ↗

16 Feb 2019

NTFS today original ↗

19 Jan 2019

Hibernation and NTFS original ↗

8 Jan 2019

What writes to the Syscache hive?original ↗

4 Jan 2019

2018

The (in)consistency of last access timestamps original ↗

15 Dec 2018

The “Last Access” updates are almost back original ↗

8 Dec 2018

The CIT database and the Syscache hive original ↗

1 Dec 2018

Exploring intermediate states of a registry hive using transaction log files original ↗

19 Nov 2018

Tools that recover deleted registry data don’t do the same job original ↗

17 Nov 2018

Effects of running an offline AV scan original ↗

25 Oct 2018

Hiding data in the registry original ↗

6 Oct 2018

Memory compression and forensics original ↗

8 Sept 2018

A live forensic distribution writing to a suspect drive original ↗

25 Jul 2018

A live forensic distribution executing malicious code from a suspect drive original ↗

21 Jul 2018