Socket Test
test
All notes
100 notesForensic Analyst as Insider Threat
The forensic analyst occupies a uniquely privileged position: they have the technical access to discover, preserve, and interpret evidence, but they also have the ability to manip…
Footprint (Forensic)
In network forensics, the **footprint** is the impact an investigator leaves on the systems under examination. Every interaction with a live system modifies it in some way—just as…
Direct Evidence
**Direct evidence** is testimony from a **direct witness** who personally observed the act or event in question. It is based on firsthand human perception rather than inference fr…
Hearsay
**Hearsay** is an out-of-court statement offered to prove the truth of the matter asserted. Under the **U.S. Federal Rules of Evidence (FRE)**, hearsay is generally **not admissib…
Business Records
**Business records** are documents or data that an enterprise routinely generates and retains as part of its normal operations, and that are considered accurate enough to guide ma…
Digital Evidence
**Network-based digital evidence** is digital evidence produced as a result of **communications over a network**. It is a subset of **[[Digital Evidence]]**, but it is distinguish…
Real Evidence
**Real evidence** is a physical, tangible object that played a relevant role in the event being investigated. It is the kind of evidence a jury can see and touch, such as the murd…
Network Evidence Challenges
Network-based evidence is a subset of [[Digital Evidence]] that comes with its own set of practical and legal headaches. Section [[1.4 Challenges Relating to Network Evidence]] gr…
Live Breach
A **live breach** is an active, ongoing security incident in which an attacker is currently connected to or operating inside a network while the investigative response is underway…
Encapsulation and Demultiplexing
**Encapsulation** and **demultiplexing** are the two complementary processes that move data through the layers of the **[[OSI Model]]**. ### Encapsulation (sender side) When data…
TCP Three-Way Handshake
The **TCP three-way handshake** is the process used by the **Transmission Control Protocol (TCP)** to establish a reliable, bidirectional connection between two hosts. It is a fou…
OSI Model
The **OSI model** (Open Systems Interconnection) is a seven-layer framework developed by ISO for designing and understanding network communications. Each layer solves a discrete …
lea vs mov [mem] in x86 Assembly
Two instructions look similar in disassembly but do opposite things with memory. | Instruction | What it does | C analogy | |-------------|--------------|-----------| | `mov ecx,…
Protocol (Networking)
A **protocol** is a set of formal rules describing how to transmit data, especially across a network. Protocols are: - Rules for successful communication between different system…
Circumstantial Evidence
[[Circumstantial Evidence]] is evidence that does **not directly prove a conclusion**, but can be linked with other evidence to **deduce** what happened. It requires inference and…
Best Evidence
**[[Best Evidence]]** is the **best available evidence that can be produced in court** to prove the content of a writing, recording, or photograph. Under the **U.S. Federal Rules …
Recursion
A classic example of recursion is the factorial [[Function Calls and Returns in Detail|function]]: `n! = n * (n-1)!` If `n` is 1, the function returns 1 ([[Reading Conditional Bra…
Frida in ROM Analysis
# Frida in ROM Analysis [[Frida in ROM Analysis]] can be used to inspect the memory layout of a ROM, hook into specific functions, or inject code to analyze the compression algori…
Docker Containers
Docker containers isolate applications by packaging code and dependencies together. They share the host OS kernel but run in separate namespaces, a form of isolation relevant to […