digital forensics

A digital forensics threat model about staged systems, mirrored machines, reputation destruction, and the weaponization of metadata.

Appending a ZIP file to the end of a JPG image is a straightforward process because the JPEG format's structure allows the image to remain valid and viewable in image viewers, while the ZIP file remains accessible with archive managers.

While .bash_history is the default for storing command history in Bash, users can configure a different filename, location, or disable bash history by setting the HISTFILE environment variable.

SharpTimestomp.exe is a simple proof-of-concept timestomp application that modifies date/time values for the file indicated in the arguments.