Digital Forensics

The VPN Was Never the Problem: How a Windows Telemetry ID Unmasked a Scattered Spider Suspect

A 19-year-old allegedly hid behind a VPN and ngrok during an $8M jewelry-retailer extortion case. Windows' Global Device Identifier (GDID) gave investigators a device-level pivot.

The Watchdog Got Bitten: Pegasus Spyware Hit the EU Committee Investigating It

A member of the EU committee investigating Pegasus abuse was hacked with Pegasus himself. Here is how forensic researchers proved it — and how to run the same detection process yourself.

DFIR 2026: Memory Forensics, Windows Artifacts, and Incident Response

Memory forensics, Windows event artifacts, and IR methodology — from initial alert to post-incident report. Tools, commands, and playbooks included.