Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Incident Response
Newest first
What Your Files Say About You: EXIF and Document Metadata for OSINT and DFIR
Photos carry GPS coordinates and camera serials; Office files and PDFs carry usernames, software versions, edit history and sometimes the text you thought you deleted. What leaks, how to extract it, how stripping works, and where analysts get fooled.
Incident Case Management: From First Alert to Final Report
Most incident response failures are bookkeeping failures: lost evidence, timelines rebuilt from memory, reports nobody can defend. How to run a case from the moment an alert gets promoted to the day the report ships.
Ransomware Response: The Decisions That Matter in the First 24 Hours
Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time.
The First 60 Minutes: An Incident Response Checklist That Works Under Stress
When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone.
Memory Forensics 101: What Lives in RAM and Why It Matters
An accessible introduction to volatile evidence: what only exists in RAM, when to capture it, and how to start analyzing memory images with Volatility 3.
Phishing Email Analysis: Headers, EML Files, and Hidden Payloads
A hands-on dissection of a suspicious email: reading the Received chain hop by hop, interpreting SPF, DKIM and DMARC verdicts, and safely extracting URLs and attachments.
Malicious JavaScript Deobfuscation: A Practical Walkthrough
Take an obfuscated JavaScript sample from unreadable to understandable: string arrays, hex escapes, eval chains and packers, dismantled step by step with safe static techniques.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note