Committing what matters, merging what sticks.

commit acce55ed (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Sat Sep 13 19:30:00 2026 +0200

    feat: 'MAC' up! 🍎

    There are about 57 artifacts in Windows forensics
    (cloud excluded), and I feel pretty safe finding and
    reading them. So I decided to switch to macOS
    forensics, where my knowledge is almost non-existent.

    I used my own tool, Pathfinder, to learn the ways of
    the Mac — and after a week I feel comfortable in the
    macOS forensic environment. There's almost always a
    Windows counterpart to help remember or understand an
    artifact. You have something called knowledgeC (or its
    upgraded version, Biome Application Usage) that shows
    how long something was active and which data was open
    — feels equal to SRUM + UserAssist. Then there are the
    logs, called the Unified Log, equal to Sysmon + Event
    Logs.

    I won't focus too much on macOS though: only a small
    share of people use it, and almost every CTF is about
    Windows or Linux. Once I know the ~45 artifacts (what
    they do + path), I'll turn my old Windows laptop into
    a "suspect laptop", generate random challenges with
    Claude AI, and just train the loop: find, extract,
    read. For example: grab NTUSER.DAT and read the MRU
    keys.

    Still a lot to learn!

commit a17fac75 (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Sun Sep  7 19:40:00 2026 +0200

    feat: drilling the artifact paths until muscle memory kicks in 🗺️

    I was really diligent these past two weeks. Finished
    two labs (Windows Endpoint Forensics with the EZ
    Tools), but I realized I don't get in contact with
    that many different artifacts. In fact, most of the
    time it's Prefetch, Amcache and of course the logs.
    But there are so many more.

    Looking at the SANS Forensic Poster, I see plenty of
    other ways to track USB evidence, or how powerful a
    source NTUSER.DAT really is.

    So I had an idea: use AI to build me a website that
    mocks the Windows Explorer — an interactive quiz to
    find artifacts. For example, where is USBSTOR? You
    click Windows/System32/config, open the SYSTEM hive,
    click into CurrentControlSet, and there it is. And
    that for almost every artifact on the SANS Poster.

    There's also a mode with a small quest, like "prove
    that a USB stick was used". You pick three sources —
    USBSTOR, setupapi.dev.log, MountPoints2 — and go. I
    really, REALLY got into the paths, and the muscle
    memory kicks in. That's exactly the point I wanted
    to reach.

    If that sounds interesting to you too, check out my
    new site: https://pathfinder.89deg.com/

    Totally free, no cookies, no ads — just fun learning
    DFIR.

commit a11c0de5 (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Tue Aug 19 22:15:00 2026 +0200

    feat: ten hours on one question, and I'd do it again 🕳️

    Upgraded CyberDefenders to Pro and started a new lab:
    Recruiter — Hanoi Op. Mostly Zimmerman tools, and
    relatively new — so no hints, no write-ups.

    In the older labs I had a rhythm: read the write-ups
    only after finishing, to see how other people reached
    the same answer; and when I got truly stuck, peek at a
    hint just to get pointed in the right direction. Having
    neither is one part amazing — I have to fight through it
    myself — and one part pure pain.

    Most questions took me somewhere between 10 and 30
    minutes. But there was one that had me stuck for about
    ten hours, spread over a week. When the answer finally
    clicked, it wasn't just relief — I learned so damn much
    from that single question, because it forced me into a
    deep dive through the $MFT and the $J. That knowledge
    will pay off for a long time.

    Seven questions to go and the frustration is at its
    peak, but I'll dig my way through every last one. And
    then: back to my beloved Volatility — I've got a feeling
    I need to refresh it before I forget everything.

commit 5e1ec7ed (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Thu Jul 30 21:40:00 2026 +0200

    feat: KAPE found 99 hives but I don't know how to use one 📊

    Second hard challenge @ CyberDefenders. Mostly incident
    analysis — and a brutal refresher on KAPE and the Zimmerman
    suite. After the TryHackMe basics I never touched them
    again, and when KAPE handed me a pile of .csv files
    (pre-parsed by the Zimmerman tools), each one with ~30
    columns and thousands of rows, I was completely lost.

    Step one: re-learn the artifacts. What is a hive, what is
    Prefetch, what is a shellbag — so I'd at least know WHICH
    csv to open.

    Step two: find something in that chaos. LibreOffice ran
    into a character limit and crashed a few times, and
    doom-scrolling with simple search doesn't scale. Enter my
    new friend: Import-Csv. I work on a Mac, a bash terminal
    is my home — so PowerShell felt anything but intuitive.
    I got used to it.

    Two evenings of learning later, Select, Where and Sort are
    my new best friends. I masterfully wrote some five-line
    queries that turned 30,000 rows into the 5 interesting
    ones — and beat the challenge.

    Memory forensics: feels fit. Windows forensics: feels fit.
    Next turn: mastering Android forensics — with a nice hard
    challenge.

commit ad5dead (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Sun Jul 19 18:20:00 2026 +0200

    feat: lost in memmap 🧠

    Focused on Volatility — memory forensics feels like the biggest
    challenge and it's my favorite tool right now. But the easy and
    medium labs got boring fast: every question was "what's the
    parent PID of this process", "what did process xy open".
    PsList, PsTree and Handles rule the whole challenge.

    So I jumped ahead to the hard ones. Best decision ever. I
    understood nothing and learned the hard way — it was awesome.
    Not "what's the parent process?" but "find the malicious
    process and the md5 it is 'hiding'".

    Steps that hurt (in a good way): learned about alternate data
    streams, dumped my first memmap, exported the strings with
    Sysinternals strings, then dug the md5 out of 1.3 million
    lines with the right regex.

    I know now: I've just scratched the surface of this tool.

    Next turn: Windows Registry forensics with the Zimmerman tools
    — and a first hard challenge there.

commit 1337c0de (HEAD -> learning-path, tag: first-hard-lab)
Author: Nils Hillmann <dfir@localhost>
Date:   Fri Jul 17 23:10:00 2026 +0200

    feat: first HARD lab in the books 🏆

    NintendoHunt @ CyberDefenders — rated hard by the platform,
    not by me. Memory dump, process hunting, Volatility.

    The toolbox counters just learned a new word: "1 hard".

commit e5f6a7b8 (HEAD -> learning-path)
Merge: a1b2c3d4 c0ffee42
Author: Nils Hillmann <dfir@localhost>
Date:   Mon Jul 13 18:30:00 2026 +0200

    feat: getting hands on 🔬

    Finished labs on CyberDefenders:

    - Hawkeye
    - Insider
    - The Crime
    - Android Breach
    - LGDroid
    - Brave
    - BlackEnergy

    Note: totally in love with Volatility 3 — thinking about
    taking on the hard challenges with it next.

commit a1b2c3d4 (HEAD -> learning-path)
Author: Nils Hillmann <dfir@localhost>
Date:   Tue Jun 30 12:00:00 2026 +0200

    feat: did 16 TryHackMe rooms to get the basics 🚀

    - Digital Forensics Fundamentals
    - Autopsy
    - Disk Analysis & Autopsy
    - Windows Forensics 1
    - Windows Forensics 2
    - KAPE
    - Linux Forensics
    - Volatility
    - Memory Forensics
    - Wireshark: The Basics
    - Wireshark: Packet Operations
    - Wireshark: Traffic Analysis
    - Intro to Malware Analysis
    - Android Analysis
    - iOS Forensics
    - Encryption – Crypto 101

    Now it's time to get the practice on CyberDefenders