Yogesh Khatri @SwiftForensics

DFIR R&D guy swiftforensics.com Sydney, Australia Joined June 2011

Tweets

551
Followers

2K
Following

124
Likes

711

Willi Ballenthin @williballenthin

a month ago

QUANTUMSTRAND beta 1 released: built for analysts to quickly understand *where* strings are, *what* they might be, and *how* important they are, without getting lost in a sea of undifferentiated text. Thanks @m_r_tz and the crew at @Mandiant FLARE github.com/mandiant/flare…

2 37 109 12K 46

Download Image

Minoru Kobayashi @unkn0wnbit

a month ago

🛠️ FJTA update released (2025-08-18)! Changes include: ✅ No longer requires TSK 4.13.0 for XFS recognition ✅ Minor code refactoring 🔗 github.com/mnrkbys/fjta #DFIR #Linux

0 4 16 1K 5

Yogesh Khatri @SwiftForensics

2 months ago

mac_apt v1.26.1 is here, now supports processing Velociraptor collections and compiled versions for macOS too. Many incremental updates and new plugins (we are at 52 plugins now!). github.com/ydkhatri/mac_a… #DFIR #macOS

0 10 30 4K 13

Minoru Kobayashi @unkn0wnbit

2 months ago

🛠️ FJTA update released (2025-07-29)! Changes include: ✅ Improved parsing of XFS journal log records ✅ Enhanced handling of directory entries (ext4/XFS) ✅ Minor bug fixes 🔗 github.com/mnrkbys/fjta #DFIR #Linux

0 6 23 1K 5

Phorion @PhorionTech

3 months ago

Introducing Phorion. A modern EDR platform purpose-built for macOS. Because security teams shouldn’t have to settle for Windows-first tools. 🛡️🍎 🧵

1 7 17 3K 4

Download Image

Yogesh Khatri @SwiftForensics

6 months ago

Found an interesting location storing wifi connect/disconnect information on #macos #DFIR swiftforensics.com/2025/01/new-wi…

1 6 29 1K 5

Minoru Kobayashi @unkn0wnbit

8 months ago

Hi, #DFIR guys, I am developing a new forensic tool for parsing journal data of #Linux filesystems (not systemd journal logs). It can not only parse filesystem journals but also generate timeline events for DFIR. This tool currently supports only EXT4, but I plan to add support…

0 19 79 5K 22

Download Image

Brian Maloney @bmmaloney97

8 months ago

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR malwaremaloney.blogspot.com/2025/01/onedri…

0 6 13 936 5

Yogesh Khatri @SwiftForensics

9 months ago

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

13Cubed @13CubedDFIR

9 months ago

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

0 7 23 3K 2

0 1 15 879 0

Yogesh Khatri @SwiftForensics

a year ago

If you've had this problem (see pic), NTFS Journal REWIND solves it! . New blog post + code. No more unknown paths. cybercx.com.au/blog/ntfs-usnj… #NTFS #DFIR

2 30 87 9K 29

Download Image

Yogesh Khatri @SwiftForensics

2 years ago

Windows Thumbnail caches are a mostly unused artifact. Did you know they can point to paths on external systems? (Yes path embedded in thumbcache file, not from win search db) Can be helpful when threat actors actively delete logs and other artifacts! #DFIR

2 25 92 8K 37

Download Image

Yogesh Khatri @SwiftForensics

2 years ago

🆕 mac_apt release v1.5.8 New modules, macOS 13 & RSR support, Python 3.10 compatibility, easier installation, bug fixes github.com/ydkhatri/mac_a… #DFIR #macOS

0 12 36 4K 5

Ali Hadi | B!n@ry @binaryz0ne

2 years ago

Hey #DFIR & #Malware community. A memory forensics case were you are required to analyze a memory dump of a Windows 10 system that has been hit with a #Ransomware. Let the games begin. Please share! $100 bounty will be paid to whoever solves this case! ashemery.com/dfir.html#Memo…

6 56 192 55K 101

Yogesh Khatri @SwiftForensics

2 years ago

Thanks for merging it @MarkBaggett. Excel output now has autowidth adjustment and auto filter applied, with frozen top row for easy analysis.

Mark Baggett @MarkBaggett

2 years ago

Thanks for merging it @MarkBaggett. Excel output now has autowidth adjustment and auto filter applied, with frozen top row for easy analysis.

1 11 25 10K 4

0 2 6 2K 2

Objective-See Foundation @objective_see

3 years ago

🛠️ Just released a new open-source utility: "DumpBTM" It can dump the persistence records of installed items (including persistent malware!) from macOS's proprietary BackgroundItems-v4.btm file. Read more: patreon.com/posts/77420730

4 49 140 44K 28

Download Image

Yogesh Khatri @SwiftForensics

3 years ago

ODL parser now updated to unobfuscate encrypted strings. MS had changed the format.. Short blog post sharing the details: swiftforensics.com/2022/11/readin… #DFIR

1 8 19 0 1

Germán Fernández @1ZRR4H

3 years ago

📌 Drivers abused by #Ransomware TA to kill AV/EDR's ▪ gdrv.sys (Gigabyte) > #RobinHood 9ab9f3b75a2eb87fafb1b7361be9dfb3 ▪ aswArPot.sys (Avast) > #CUBA and #AvosLocker a179c4093d05a3e1ee73f6ff07f994aa ▪ mhyprot2.sys (Genshin Impact) > #Rever 4b817d0e7714b9d43db43ae4a22a161e

3 100 228 0 52

Download Image

Bradley Schatz @blschatz

3 years ago

The DFRWS APAC conference is happening *in-person* in Adelaide, Australia Sept 28-30, with the program virtual-friendly. Do join us for the second of what we aim to become a regular forum for the Asia-Pacific #DFIR practitioner and researcher community to connect.

DFRWS @DFRWS

3 years ago

1 8 13 0 0

Download Image

0 2 2 0 0

Brian Maloney @bmmaloney97

3 years ago

In OneDrive, when a file is deleted that is not on the local filesystem, it is moved to the cloud recycle bin. This can be problematic during endpoint investigations. By incorporating ODL logs, we can find this data. Did Fred Rogers delete more that we were lead to believe? #DFIR

2 68 240 0 52

Download Image

Yogesh Khatri @SwiftForensics

4 years ago

So the first part of the blog post on OneDrive Logs (ODL) is finally posted, and so is the python script to parse it! 👇 swiftforensics.com/2022/02/readin… and github.com/ydkhatri/OneDr…