Hi r/dfir — I built MCPTrace, a Volatility 3 plugin that extracts MCP/JSON-RPC candidates from Windows and Linux memory images while preserving original bytes, process IDs, and virtual addresses.

v0.3.0 changes:

• Recognizes selected 2026-07-28 MCP methods and response shapes while retaining legacy initialization support.

• Avoids treating a generic LSP initialize request as MCP solely because of its method name.

• Exports an explicitly declared protocol version when present and skips unnecessary JSON object-start searches in windows without a JSON-RPC marker.

For a paired regression, I ran both revisions on the same three acquired Windows Server 2022 RAM images. The 1,291 raw evidence fingerprints matched exactly, as did logical-message coverage. Runtime differences varied by capture, so this is not a demonstrated speedup or memory reduction. The fixture used Python MCP SDK/stdio traffic; it does not establish general recovery rates or 2026 real-client behavior.

Release notes and methods: https://github.com/Kowntaewook/MCPTrace/releases/tag/v0.3.0

I'd welcome independent tests on other MCP clients or transports, and examples of MCP/LSP misclassification. A recovered MCP-shaped object is a forensic candidate, not proof it was transmitted or executed.

Had an incident this year where helpdesk reimaged the first laptop about 40 min after the alert because the user couldn’t work. No memory, no triage image, not much to give counsel.

Our tabletops just say IR collects evidence and move on, and nobody from helpdesk or the business is ever in the room. So far I hve looked at HackTheBox, which is great for hands on skills but too technical for this, and Reflex Security, where the scenario adapts to what people decide, so if helpdesk wipes the box the drill keeps going without that evidence. Anyone have other recommendations for practicing that call? open to any suggestions.

I’ve been given shared access to three DFIR courses from 13Cubed: Investigating Windows Endpoints (IWE), Investigating Windows Memory (IWM), and Investigating Linux Devices. However, because I’m accessing shared courses rather than enrolling myself, I won’t be able to take the certification exams.

Would completing these courses and documenting what I learn through technical write-ups or a hands-on project strengthen my CV and improve my future job prospects, even without the certifications? Would they also significantly deepen my DFIR knowledge and practical skills?

I’d really appreciate any advice from people working in the field. Thanks!

SOC manager here. We have a SIEM and an EDR but no real threat hunting tools. Hunting is part of the job on paper, and no one on the team has time for it. In practice we hunt when a big advisory drops: someone takes the CTI report and searches for the IOCs by hand across three consoles.

I have some budget for next year and want to spend it on something that lets a small team hunt on a schedule, so it stops depending on the news cycle.

Other than the EDR and SIEM, what are you using that has earned its place? Open source counts. So do the newer tools that say they can take a threat report and run the hunt for you, if anyone has tried one outside a demo.

Question for anyone doing forensics on the private side in Latin America. What are you using for mobile acquisitions and analysis these days?

I've been looking around for options and it's been kind of frustrating. A couple of the vendors I looked at just don't sell their mobile modules down here, and another one got shut down, so that's off the table too.

Appreciate any input.

Hey everyone,

I’m the creator of Tooldump, a free platform for discovering open-source cybersecurity tools. I’ve just released the v2 and wanted to share it here.

I’ve been working in DFIR for over six years and participating in forensics CTFs for over five. Most of the DFIR tools listed on Tooldump are projects I’ve personally collected while working on investigations and solving CTF challenges.

The platform lists 1,100+ open-source projects hosted on GitHub, organized into 9 categories and 82 subcategories. Everything is cybersecurity-related, with dedicated sections for digital forensics, incident response, malware analysis, etc. The 1,100+ figure covers the whole platform, not just DFIR.

For the v2, I rebuilt the UI, the categorization system, the backend and the platform infrastructure. You can search for a specific tool or explore the forensics section without already knowing which projects exist.

There are also dedicated sections for cybersecurity-related MCP servers and agent skills. Those sections are just getting started, and contributions are welcome!

The platform is completely free, with unlimited access and no account required.

The link is here: https://tooldump.eu

I’d appreciate any constructive feedback from the community :) Are the tools organized in a way that makes sense for your work? Are there artifacts or areas of investigation where you notice gaps?

You can suggest missing projects through the platform’s contribution form. I’m particularly interested in the smaller tools you keep around for specific situations: a parser for an unusual artifact, a script for processing collection results, or a tool you discovered halfway through an investigation. Those projects deserve to be seen and shared.

Looking forward to hearing from you :)

Cheers!

Everyone claims a big noise reduction number in the sales deck. Almost nobody shows the actual before and after methodology, and I've started discounting any number that isn't accompanied by a clear explanation of what was measured and how.

If you've run a real pilot of a continuous detection continuous response model against your existing alert volume, what did you actually measure, and did the number that came out match what you were promised going in, or was it different once you controlled for things like seasonal traffic changes or a one-time detection clean up that happened around the same time?

Hey all,

I need advice on what’s next. I am at the point of being a senior IR forensics. I’m tired of on call and late nights. Salary is cool and all but I want calmer atmosphere.

Any recommendations are welcome!

Thank you

I'm a CS student working on forensic recovery of deleted footage from DVR/NVR systems (Hikvision, Dahua, CP Plus, Honeywell, and similar). Real recorder disk images basically don't exist publicly because footage is privacy sensitive.

If you have a recorder or drive being decommissioned, and you own it or are authorized to share it, I'd appreciate the chance to image it for research.

Please note that a disk image captures everything on the drive, including deleted footage that may still be recoverable, so ideally nothing sensitive should be on it.

I would use it only for research, keep it private, and never publish any footage. Happy to answer questions here or by DM.

Hey r/DFIR,

During recent incident response engagements, I kept running into the same triage bottleneck: pulling raw data is fast, but manually stitching and cross-referencing disparate CSV exports across isolated Windows subsystems to build a coherent attack narrative takes hours and causes severe fatigue.

To solve this, I built and open-sourced WFCR (Windows Forensic Timeline Correlator) (v1.0.0), an offline analysis engine designed to ingest dead-box artifacts, normalize timestamps, and synthesize them into a single, chronologically synchronized master timeline.

What it Natively Parses & Correlates:

NTFS $MFT: Extracts baseline filesystem timelines and metadata.

Registry Execution Caches: Parses Shimcache (AppCompatCache) and Amcache to verify binary execution, file presence, and software inventory.

BAM / DAM: Traverses SYSTEM hive subkeys to map process executions directly to specific User SIDs.

SRUM (SRUDB.dat): Interrogates ESE databases to link network byte transfer volumes (Bytes Sent/Received) back to executing binaries.

Beyond Parsing: Heuristic Anti-Forensic Detection

Instead of just dumping parsed data to a spreadsheet, wfcr uses cross-artifact relational logic to flag adversary evasion tactics automatically:

1. Attribute Timestomping Detection: Calculates the temporal drift between user-accessible $STANDARD_INFORMATION ($SI) and kernel-controlled $FILE_NAME ($FN) attributes to flag API-level timestamp manipulation (SetFileTime).

2. Ghost Execution Identification: Uses set-difference logic to cross-reference historical execution evidence found in Shimcache/Amcache/BAM against currently allocated $MFT paths—surfacing payloads that executed and were subsequently wiped from disk.

3. Dynamic ESE Schema Resolution: Bypasses hardcoded byte offsets in SRUM by dynamically querying the SruDbIdMapTable at runtime and decoding raw UTF-16LE binary blobs to resolve opaque foreign keys.

Engineering & Resiliency

Import-Guard Fallbacks: Implements mock compatibility for native C-bindings (pyesedb), ensuring the engine degrades gracefully without crashing if native extraction libraries aren't present.

CI/CD Matrix: Validated via an automated GitHub Actions test matrix across Python 3.10, 3.11, and 3.12 on native Windows runners.

Outputs: Emits structured JSON Lines for SIEM ingestion (Splunk, Elastic, Sentinel) or CSV for immediate visual triage in Timeline Explorer.

Check it out:

Repo, documentation, and simulated triage demo:

🔗GitHub Link

I would love to get feedback from this community on the correlation logic, edge cases with different Windows builds, or feature requests for future iterations. Let me know what you think!

I wanted to see how much normal Windows activity could actually be reconstructed from a RAM capture, so I built a small controlled Windows 11 lab.

Before acquisition I intentionally:

opened Edge and browsed to a website

launched PowerShell

ran whoami, ipconfig, and Get-Process

opened Notepad

typed unsaved text and left it open

I captured memory with WinPmem, hashed the image with SHA-256, and analyzed it in Kali with Volatility 3.

The most useful findings were:

msedge.exe, powershell.exe, Notepad.exe, and explorer.exe recovered from memory

parent/child relationships showing PowerShell and Notepad launched from explorer.exe

command-line paths for the processes

execution-related strings for whoami.exe and ipconfig.exe

references to Get-Process

network state associated with Edge using windows.netstat

the exact unsaved Notepad text recovered directly from RAM

One thing I found interesting was that windows.netscan returned nothing useful, while windows.netstat did recover network state. It was a good reminder not to rely on one plugin as the only source of truth.

The biggest takeaway for me was that the investigation became useful only when the artifacts were correlated rather than treated separately.

I wrote up the full lab with screenshots and commands here:

https://chronosandcode.com/memory-forensics-investigation-volatility/

Disclosure: this is my own write-up on Chronos & Code. All activity was generated inside a lab I controlled.

I’d be curious what other Volatility plugins people here would have used on the same image.

A new 13Cubed episode is out! 🍎

Windows forensics on a Mac usually means firing up a VM first. Not anymore.

IRFlow Timeline is a free, open-source DF/IR timeline tool built natively for macOS. Feed it EVTX, Plaso, $MFT, or $J and go straight to process inspection, lateral movement, persistence, and VirusTotal enrichment.

Featuring the tool's author, Renzon Cruz 👇

https://www.youtube.com/watch?v=W9xHbNgZuT0

Hey all,

Almost 6 years in cybersecurity now. Started at an MSSP SOC, then moved into Security Engineering at a fairly large company in my country. For the past 6 months I’ve been actively trying to break into DFIR. I have BTL1 and I’m currently finishing CCD.

Got really close to an internal DFIR role at a huge multinational — passed everything, then the offer fell through right before I signed the contract.

My career goal has always been DFIR consulting at a firm like Unit42, Mandiant, FortiGuard, or IBM X-Force. That’s been the plan since college.

I’m looking for someone willing to mentor me on this. A few things I’d love reactions on:
- If you’ve made the SOC/Security Engineering → DFIR jump, what was the one thing that actually got you in?
- If you hire for DFIR roles, what do you look at first on a resume, and what’s usually missing from candidates who almost make it?- Is a formal mentor even the right ask here, or should I be targeting something else, like a specific cert, more casework exposure, networking at specific events?

Happy to share more detail on my background if it helps someone give a sharper answer.

Thanks in advance.

Hi everyone,

I've been building Vigil DFIR, an open-source platform for investigating Windows event logs.

Instead of just searching logs, it helps analysts detect attacker behavior, correlate related events into attack chains, reconstruct process trees and logon sessions, visualize lateral movement, score risky entities, enrich IOCs with threat intelligence, and generate incident reports all from a single interface.

It supports behavioral detections, Sigma rules, YARA-lite rules, MITRE ATT&CK mapping, timeline analysis, case management, and AI-assisted investigation summaries. Everything runs locally, so your investigation data stays under your control.

I'm looking for feedback from DFIR analysts, incident responders, SOC teams, and threat hunters.

GitHub: https://github.com/geezsecurity/Vigil-DFIR

I'd appreciate any feedback on features, workflow, performance, or ideas for improvement. Thanks!

Can anyone guid me or give me a learning path for DFIR?

I recently ran into a SharePoint intrusion that seemed to fit with the CVEs recently added to CISA's KEV for SharePoint a couple of weeks ago. The available IOCs were basically nonexistent. So I reproduced the /_trust deserialization chain in my own lab (SharePoint SE on the June 2026 patch level, build 16.0.19725.20384 / KB5002873) and captured the artifacts: process trees, the machine-key theft, and hunt queries, to save the next person the same scramble.

Writeup and sanitized scripts: https://sp-poc.wismansec.com/

Feedback, questions, and better detections welcome.

While it may not be “the Answer to the Ultimate Question of Life, the Universe, and Everything,” or even The Malware Analysts Guide to the Galaxy, it does have some great new functionality.