Andrea Fortuna

A Canadian man spent eighteen months in prison because investigators mixed up two Kik usernames differing by a single underscore, a case that says as much about human negligence as about technology.

A DFIR-focused look at three NTFS heap overflow vulnerabilities exploited through crafted VHD files, with detection rules and forensic artefacts to hunt for.

Link roundup for the week of August 9 to August 16, 2026: the White House authorizes private companies to conduct offensive cyber operations, while four separate disclosures reveal AI agents autonomously breaching real organizations.

Summer staffing gaps expose whether NIS2 and DORA compliance was ever more than paperwork, and autumn deadlines will make that gap impossible to hide.

A DFIR-focused look at the Pass-ta-key attacks against Google's synced passkeys, with forensic artifacts, detection rules and IOCs for defenders.

Link roundup for the week of August 2 to August 9, 2026: high-profile cybercrime convictions arrive years after the damage was done, while thousands of industrial controllers remain exposed online despite years of federal warnings.

Most organizations treat the post-incident review as paperwork. Here is why that habit is expensive, and what actually turns an incident into a lesson.

The P.E.T. Guide (Peer-to-peer, Encrypted, Tor) is a privacy manual that every digital forensics investigator should read - not to follow its advice, but to understand what they are up against.

Link roundup for the week of July 26 to August 2, 2026: frontier AI models autonomously breached real production systems, North Korean operatives spent years compromising npm's supply chain, and the trust boundaries we've relied on are fraying at both end

A technical examination of the forensic artifacts generated by AI assistants embedded in Edge and Chrome, from IndexedDB caches to sync telemetry.