Loading…
FORENSYRA
Where Digital Truth Takes Form
> initialising forensyra shell_
000% · SECURING SESSION
NoticeApplications are open — join the founding team and help build the first student-led DFIR collective.
Lab Notes
Investigation logs, tutorials, and research — documented as we learn and as cases progress.
Latest Publications
Investigation logs, tutorials, and research documented as we learn and as cases progress. Search the archive, or filter it down by topic.
10 of 10 write-ups
RFC 3227 gives us a priority order for collecting evidence. Here is what it really says, and the mistakes we still see in lab exercises.
A hash is the backbone of evidence integrity. It is also widely misunderstood. Here is exactly what a digest can and cannot tell you.
Event IDs 4624, 4625 and 4648 are the backbone of Windows authentication analysis. Here is what each field actually tells you.
A super timeline merges filesystem, registry, log and network events into one chronology. It is also the fastest way to drown in data.
Three Windows artefacts that all seem to answer 'did this program run?' — and each one answers a slightly different question.
The most technically brilliant investigation fails if you cannot show who touched the evidence. Here is the minimum a custody log must contain.
A phishing investigation usually starts with a header. Learn to read one from the bottom up, and to know what a header can't tell you.
A finding nobody can act on is not a finding. How we structure investigation reports so they survive review, repetition and a courtroom.
Hash it, track it, protect it: the chain-of-custody habits every Forensyra member follows from day one.
Why we are building a student-led DFIR collective, and what you can expect from us.
Join the Collective
Document your analysis, publish your write-ups, and help the next cohort learn faster.
Learn
Document
Publish