Reproducibility

2026-09-20

**Reproducibility** is the principle that a forensic process or finding must be capable of being repeated by an independent party, using the same procedures, and yielding the same…

Progressive Change

2026-09-20

**Progressive change** is the principle that digital evidence is not static: systems, files, and data continually change through normal use, automated processes, and the passage o…

Objectivity

2026-09-20

Objectivity is the discipline of forming conclusions from the evidence rather than selecting evidence to fit a conclusion. ## Explanation In forensic work, ego is the enemy. The…

Lawfulness

2026-09-20

**Lawfulness** is the principle that every forensic action — from evidence collection through analysis to presentation — must be carried out under proper legal authority and withi…

Integrity

2026-09-20

**Integrity** is the assurance that digital evidence remains complete, accurate, and unaltered from the moment of acquisition through analysis, storage, and presentation in court.…

Evidence Preservation

2026-09-20

**Evidence Preservation** is the set of practices used to maintain the original state, integrity, and availability of digital evidence from the moment of collection through its pr…

Defensibility

2026-09-20

**Defensibility** is the quality of a forensic process or finding such that it can withstand scrutiny from opposing counsel, technical experts, and the court, because every step t…

Chain Of Custody

2026-09-20

**Chain of custody** is the documented, unbroken record of who collected, handled, transferred, and stored a piece of evidence from the moment of acquisition until it is presented…

Investigative Event Log Discovery Strategy

2026-09-20 #powershell #windows-event-logs #digital-forensics #investigation-strategy #get-winevent #xpath-filter

# Investigative Event Log Discovery Strategy When you need to find events in Windows but do not yet know the exact log, event ID, or provider, follow a repeatable discovery proce…

Reading and Complying with Assignment Specifications

2026-09-20 #learning-essential-python-for-pentest-and-reverse #assignments #specifications #checklist #file-io #workflow #soft-skills

Getting code to run is only half of an assignment. The other half is proving that the code satisfies every requirement in the specification. Missing requirements like "write outpu…

Installing and Troubleshooting pip and uv

2026-09-20 #python #environment #pip #uv #setup #learning-essential-python-for-pentest-and-reverse

# Installing and Troubleshooting pip and uv Most [[Python Essentials for Security Scripting|Python]] installations ship with `pip`, but it can be missing, outdated, or not on you…

PowerShell Get-Help Parameter Discovery

2026-09-20 #powershell #get-help #cmdlet-discovery #digital-forensics

# PowerShell Get-Help Parameter Discovery Use `Get-Help` with the `-Parameter` switch to learn about a specific parameter of a CmdLet. ```powershell Get-Help Get-ChildItem -Para…

PowerShell Custom Objects

2026-09-20 #powershell #objects #json #custom-objects #serialization

PowerShell is built around **objects** rather than plain text. CmdLets like `Get-Process` return objects with **properties** (data) and **methods** (actions). Objects make it easy…

Select-Object

2026-09-20 #powershell #select-object #pipeline #properties

`Select-Object` is a PowerShell CmdLet that selects or shapes the properties of objects coming through the pipeline. It is commonly used to limit output, pick specific properties,…

PowerShell ForEach-Object CmdLet

2026-09-20 #powershell #foreach-object #pipeline #cmdlet #iteration

`ForEach-Object` is a PowerShell CmdLet that processes each object coming through the pipeline one at a time. It is the standard way to run a script block against every item in a …

PowerShell EventLog CmdLets

2026-09-20 #powershell #forensics #event-logs #windows #chethosmer

PowerShell provides built-in **EventLog cmdlets** for collecting and inspecting Windows event logs. The most commonly used cmdlet is **Get-EventLog**, which retrieves events from …

Inspecting .NET Classes from PowerShell

2026-09-20 #powershell #.net #reflection #discovery

PowerShell can instantiate and inspect .NET objects directly. The [[Get-Member CmdLet]] is central to this, as covered in [[Experimenting with PowerShell]]. A practical discovery …

Debugger Suspend Does Not Kill the Process

2026-09-20 #debugging #ida #reverse-engineering #learning-essential-python-for-pentest-and-reverse

In a [[Debugger attach and ASLR rebasing pitfalls|debugger]], **suspend** means pausing the target process, not killing it. The OS scheduler simply stops giving the process CPU ti…

Decoding IDA-Style Argument Offsets

2026-09-20 #assembly #x86 #reverse-engineering #stack-frame #ida #calling-convention #understanding-assembly-via-examples

In 32-bit x86 code compiled with a stack-based calling convention [[x86 Calling Conventions: cdecl vs stdcall]] (`cdecl` or `stdcall`), arguments are accessed as positive offsets …

Function Prologue Decomposition Methodology

2026-09-20 #understanding-assembly-via-examples #assembly #x86 #reverse-engineering #methodology

# Function Prologue Decomposition Methodology When you open an x86 function, do not read line-by-line. Read the **prologue as one block** and answer these five questions before a…