Stephen K.
Digital Forensics | Incident Response | DFIR
As a Digital Forensics and Incident Response (DFIR) Specialist, I provide end-to-end investigative, recovery, and threat intelligence services. From compromised systems to insider threats and malware infections to data breaches, I offer deep forensic analysis across Windows, Linux, Mac, Mobile (iOS & Android), Network, Cloud, and Dark Web environments. My forensic services helps individuals and organizations: • Investigate data breaches and cybercrimes • Recover critical data from failed or deleted systems • Analyze malware-laced documents and suspicious files • Track unauthorized activity across networks and endpoints • Provide court-admissible evidence for legal proceedings 🔐 Service Domains 1. 📥 Data Acquisition & Preservation I offer industry-standard digital evidence acquisition services across physical and logical environments, ensuring integrity, chain of custody, and forensic repeatability. • Recovery of lost, deleted, and hidden data from HDDs, SSDs, USBs, SD cards using: Easy US Data Recovery, R-Studio, Disk Drill • Creation of forensic disk images: R-Drive Image, dd, FTK Imager, X-Ways Forensics • Live memory (RAM) acquisition: Windows: Belkasoft Live RAM Capturer, DumpIt Linux: LiME, fmem macOS: OSXPmem, Memoryze Remote: LiME + ncat, PsExec • Imaging and mounting: Convert .E01 to .dd with xmount , Mount .dd with loopback devices (mount -o loop) • Hash generation and verification: HashCalc, MD5 Calculator 2. 🧨 Bypassing Anti-Forensic Techniques I specialize in detecting and reversing anti-forensics tactics to hide, obfuscate, or destroy data. • Analyze stego encrypted files using: StegSpy, ZSteg, DeepSound, OpenStego • File extension spoofing detection via File Viewer, Hex Editor • Detection of Alternate Data Streams (ADS) • Bypassing packing and obfuscation: PEiD, Unpacker, die (Detect It Easy), Exeinfo PE • Recovery from encrypted containers using: Veracrypt detection, Hashcat 3. 🪟 Windows Forensics Full investigation of compromised or suspect Windows systems, volatile and non-volatile. • Volatile memory investigation with Volatility, Redline, MemProcFS • Windows Registry capture and analysis: FTK Imager, Registry Explorer, RegRipper, Hex Workshop • Log analysis:Event Log Explorer, EVTXtract • Live session inspection: PSLoggedOn, NetFile, LogonSessions, OpenFiles • Password hash extraction: pwdump, Mimikatz • Browser forensics: Chrome: ChromeCacheView, History Viewer Firefox: MZCacheView, MZCookiesView • Suspicious process & driver analysis: Process Hacker, Process Explorer • SQLite DB extraction: DB Browser for SQLite, SQLite Forensic Toolkit 4. 🐧🍏 Linux & macOS Forensics Investigate and analyze Linux and macOS endpoints using industry-standard open-source and commercial tools. • Live memory acquisition: Linux: LiME, fmem, /dev/mem Mac: OSXPmem, Memoryze • Mount and analyze Linux file systems (ext3, ext4, Btrfs) • Analyze logs (/var/log, .bash_history, systemd journals) • Full disk imaging using dd • Timeline reconstruction:mactime, Log2Timeline • RAM dump analysis with Volatility (Linux Profile) 5. 🌐 Network Forensics Investigate and analyze suspicious network activity, data exfiltration attempts and lateral movement • Packet sniffing and deep packet inspection: Wireshark, TShark, tcpdump • PCAP filtering using Scapy, Zeek • Exfil detection from auth.log, Kiwi Log Viewer 6. 🌍 Web Application Attack Forensics Identify and trace attacker behaviour within compromised web applications, APIs, and backend logs. • Splunk and Suricata-powered log aggregation, threat hunting, and dashboard creation • Extraction of client IPs, user-agent analysis, bot detection 7. 🕵🏾♂️ Dark Web & TOR Forensics Identify TOR usage and dark web activity from volatile memory and memory dumps. • Windows Prefetch and shortcut file analysis to detect TOR Browser execution • RAM dump analysis for .onion domains, encryption keys • Process memory analysis using Volatility plugins (yarascan, netscan) 8. ☁️ Cloud Infrastructure Forensics (AWS, Azure, GCP) • Snapshot analysis of cloud VMs, storage, logs • For AWS: IAM & API call audits using SkyArk, AWS CLI • For Azure: VHD analysis, Key Vault secrets review, • GCP: Access log parsing, snapshot retrieval, forensic memory dump 9. 📧 Email & Social Media Forensics • Email header and metadata analysis for spoofing/phishing detection • Recover deleted emails using Recover My Email, Kernel for Outlook PST Recovery • Parse and analyze EML, PST, MBOX with Python scripts, MailXaminer, Xtraxtor 10. 📱 Mobile Forensics Deep-dive forensic investigation of iOS and Android mobile devices. • Android: Logical & physical acquisition using Magnet AXIOM, ADB, Cellebrite • iOS: Use of Magnet AXIOM, iTunes backup parsing • Cloud sync analysis:iCloud, Google Drive artifact extraction • App-specific analysis: WhatsApp, Telegram, Signal, Snapchat