// DIGITAL FORENSICS & INCIDENT RESPONSE — LEARNED IN PUBLIC
Welcome to my forensic lab diary.
Hi, I’m Nils — I’m working my way toward a job in DFIR. Watch me learn, break things, fail, and share what sticks along the way.
OF THE WEEK WK 34 / 2026
SMTP
A postman who delivers every letter without ever checking who really wrote it. That's SMTP — and that's exactly why 'From: your CEO' means almost nothing on its own. Meet Bob's three allies: SPF, DKIM and DMARC.
READ THE WRITE-UP →ARTICLES
all write-ups →FIELD NOTES
commit acce55ed (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date: Sat Sep 13 19:30:00 2026 +0200
feat: 'MAC' up! 🍎
There are about 57 artifacts in Windows forensics
(cloud excluded), and I feel pretty safe finding and
reading them. So I decided to switch to macOS
forensics, where my knowledge is almost non-existent.
I used my own tool, Pathfinder, to learn the ways of
the Mac — and after a week I feel comfortable in the
macOS forensic environment. There's almost always a
Windows counterpart to help remember or understand an
artifact. You have something called knowledgeC (or its
upgraded version, Biome Application Usage) that shows
how long something was active and which data was open
— feels equal to SRUM + UserAssist. Then there are the
logs, called the Unified Log, equal to Sysmon + Event
Logs.
I won't focus too much on macOS though: only a small
share of people use it, and almost every CTF is about
Windows or Linux. Once I know the ~45 artifacts (what
they do + path), I'll turn my old Windows laptop into
a "suspect laptop", generate random challenges with
Claude AI, and just train the loop: find, extract,
read. For example: grab NTUSER.DAT and read the MRU
keys.
Still a lot to learn!TOOLBOX
Registry Explorer, ShellBags Explorer, MFTECmd, Timeline Explorer & friends — one author, one ecosystem, and the standard drawer of Windows artifact parsers in DFIR.
Memory forensics framework. Process trees, injected code, registry hives from RAM — the evidence that vanishes on reboot.
Packet analysis. From DHCP handshakes to carved TCP streams — reading traffic byte-by-byte and turning it into a story.
Raw queries against app databases — what the parsers read, I read too. WAL files, freelists, deleted records; the layer under every mobile artifact.
Android Logs, Events And Protobuf Parser. Turns a raw Android extraction into a readable timeline — logs, events, usage stats, app databases.
Open-source disk forensics platform. Timeline analysis, keyword search, file carving — where imaged evidence becomes a case.
Kroll Artifact Parser and Extractor. Targeted triage collection — grab what matters in minutes instead of imaging for hours.
Forensic disk imaging, evidence preview and export. Acquisition workhorse: image, hash, verify, then work on the copy — never the original.
No self-scores here — every level is backed by completed labs, and the difficulty ratings come from the platforms, not from me. I’d rather show receipts than numbers.
> full toolbox with receipts →Hiring for a junior DFIR or SOC role? Let’s talk.
Everything on this site is my own work — dated, verifiable, and honest about what I don’t know yet. Happy to walk you through any of it.