// DIGITAL FORENSICS & INCIDENT RESPONSE — LEARNED IN PUBLIC

Welcome to my forensic lab diary.

Hi, I’m Nils — I’m working my way toward a job in DFIR. Watch me learn, break things, fail, and share what sticks along the way.

STATUS: open for junior DFIR / SOC roles · last updated 2026-07-15
PROTOCOL
OF THE WEEK
WK 34 / 2026

SMTP

tcp/25 · RFC 5321

A postman who delivers every letter without ever checking who really wrote it. That's SMTP — and that's exactly why 'From: your CEO' means almost nothing on its own. Meet Bob's three allies: SPF, DKIM and DMARC.

READ THE WRITE-UP →
2026-08-17 Dave Is No Billionaire CEO — SMTP A postman who delivers every letter without ever checking who really wrote it. That's SMTP. And that's exactly why 'From: your CEO' means almost nothing on its own. NETWORK 2026-08-02 Excuse me, what time is it? — NTP A passenger's expired ticket looks perfectly valid — on his phone. Who gets to decide what 'now' really is? That's NTP: the time everyone in a network agrees on, handed down from an atomic clock. NETWORK 2026-07-26 DORA knows where you sleep — DHCP You don't just grab a random hotel room — you talk to Alice at the front desk. DHCP works the same way: Discover, Offer, Request, Acknowledge, and you've got an IP with a checkout date. NETWORK

FIELD NOTES

lab log — what I’m actually doing
2026-09-13
commit acce55ed (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Sat Sep 13 19:30:00 2026 +0200

    feat: 'MAC' up! 🍎

    There are about 57 artifacts in Windows forensics
    (cloud excluded), and I feel pretty safe finding and
    reading them. So I decided to switch to macOS
    forensics, where my knowledge is almost non-existent.

    I used my own tool, Pathfinder, to learn the ways of
    the Mac and after a week I feel comfortable in the
    macOS forensic environment. There's almost always a
    Windows counterpart to help remember or understand an
    artifact. You have something called knowledgeC (or its
    upgraded version, Biome Application Usage) that shows
    how long something was active and which data was open
    — feels equal to SRUM + UserAssist. Then there are the
    logs, called the Unified Log, equal to Sysmon + Event
    Logs.

    I won't focus too much on macOS though: only a small
    share of people use it, and almost every CTF is about
    Windows or Linux. Once I know the ~45 artifacts (what
    they do + path), I'll turn my old Windows laptop into
    a "suspect laptop", generate random challenges with
    Claude AI, and just train the loop: find, extract,
    read. For example: grab NTUSER.DAT and read the MRU
    keys.

    Still a lot to learn!
> full log continues in the archive_ →

TOOLBOX

no self-scores — completed labs, difficulty rated by the platform
6 labs · 2 hard

Registry Explorer, ShellBags Explorer, MFTECmd, Timeline Explorer & friends — one author, one ecosystem, and the standard drawer of Windows artifact parsers in DFIR.

working proficiency
5 labs · 1 hard

Memory forensics framework. Process trees, injected code, registry hives from RAM — the evidence that vanishes on reboot.

working proficiency
4 labs · 2 medium

Packet analysis. From DHCP handshakes to carved TCP streams — reading traffic byte-by-byte and turning it into a story.

working proficiency
3 labs · 2 medium

Raw queries against app databases — what the parsers read, I read too. WAL files, freelists, deleted records; the layer under every mobile artifact.

working proficiency
ALEAPP
3 labs · 1 medium

Android Logs, Events And Protobuf Parser. Turns a raw Android extraction into a readable timeline — logs, events, usage stats, app databases.

hands-on, learning
2 labs · 1 medium

Open-source disk forensics platform. Timeline analysis, keyword search, file carving — where imaged evidence becomes a case.

hands-on, learning
KAPE
2 labs · 1 hard

Kroll Artifact Parser and Extractor. Targeted triage collection — grab what matters in minutes instead of imaging for hours.

hands-on, learning
1 lab

Forensic disk imaging, evidence preview and export. Acquisition workhorse: image, hash, verify, then work on the copy — never the original.

hands-on, learning
JADX
1 lab · 1 medium

Dex-to-Java decompiler with GUI. Opens an APK and turns the bytecode back into readable Java — manifest, resources, code structure, all searchable.

explored

No self-scores here — every level is backed by completed labs, and the difficulty ratings come from the platforms, not from me. I’d rather show receipts than numbers.

> full toolbox with receipts →

Hiring for a junior DFIR or SOC role? Let’s talk.

Everything on this site is my own work — dated, verifiable, and honest about what I don’t know yet. Happy to walk you through any of it.