David B.

I specialize in Windows and macOS endpoint forensics and incident response, helping companies and individuals understand what happened on a device, how it happened, and what to do next. Although I use enterprise systems (for example Defender, Sentinel, Splunk, QRadar, etc.) every day, my work here on Upwork focuses on host-based investigations — analyzing native operating system artifacts to identify malware activity, unauthorized access, persistence mechanisms, and attacker behavior. I hold 13Cubed certifications in Windows and macOS endpoint investigation, which emphasize real-world DFIR methodology and attacker tradecraft rather than theoretical knowledge. What I can help you with: • Investigating suspicious activity on Windows or macOS endpoints • Malware execution & persistence analysis • Timeline reconstruction (what happened, when, and by whom) • Registry, event log, and filesystem artifact analysis (Windows) • macOS persistence & execution artifact investigation • Living-off-the-land technique detection (PowerShell, LOLBins, native tools) • Post-incident analysis and remediation guidance Typical use cases: “We think this workstation was compromised” “Defender / EDR alerted but we don’t understand what happened” “We need to verify if malware actually executed” “We need forensic confirmation, not assumptions” I provide clear findings, evidence-based conclusions, and actionable next steps — whether you need a quick triage or a deeper investigation. Discretion, accuracy, and professionalism are a priority in every engagement.