London, UK -  Cyber security professional specialising in detection and response, sporadically blogging about technology and life to scratch a writing itch from a previous life as a journalist

Recent blog posts

Using Tkinter to build simple GUIs for Python apps
 -  I’ve written many Python scripts and apps in the past, including my Windows backup utility Backutil, which is probably the my most complex project to date. But I’ve always designed these to run in the background or on the command line, and haven’t ever tried to build an app with...
Linux .bash_history: Basics, behaviours, and forensics
 -  During any incident investigation on a Linux system, one of the most valuable things for responders and forensicators to establish is which commands were run. This is key to finding out what an attacker or malicious user was attempting to do, and what remediation activities are required. The .bash_history file,...
SANS Holiday Hack Challenge 2021: Slot machine walkthrough
 -  Here’s one more writeup from the SANS Holiday Hack Challenge! The slot machine hack was one of the showpiece challenges this year, so I thought I’d put together a quick blog post to guide you through the process of identifying and exploiting a vulnerability in the game. The challenge Our...
SANS Holiday Hack Challenge 2021: Yara rule analysis walkthrough
 -  Over the Christmas break I took part in an annual tradition - the SANS Holiday Hack Challenge! For 2021 the team had put together a fresh set of challenges for this festive CTF, and now that the deadline for submissions and subsequent embargo has passed, I thought I’d share a...
Backutil development: Implementing multiprocessing in Python
 -  I’m still hard at work on Backutil, my simple Windows backup utility with automatic rotation features, fitting in little tweaks and improvements around my daily schedule. The latest of these - and perhaps the most impactful in terms of performance - involves the implementation of multiprocessing for several parts of...
Installing Splunk Free in a virtual machine for log analysis
 -  Splunk is considered the gold standard for analysis of event logs and other data, but unless you’re lucky enough to work for an organisation that pays for it, it can be difficult to get practical experience in how to run searches, build dashboards, and otherwise dissect data using its query...
File carving: Recovering a deleted file from a Windows disk image
 -  Most computer users assume that when they delete a file and empty the Recycle Bin, it’s gone forever. After all, if Windows doesn’t show us a file, it doesn’t exist anymore, right? Wrong. With the right tools and knowledge, forensics experts can find fragments - or even complete versions -...
Backutil development: Building and JOINing SQLite databases in Python
 -  This post is something of a development diary for Backutil - my Python-based utility for backing up files from Windows systems. I published the first version of Backutil (v0.51) at the beginning of 2021, and pushed a small update (v0.52) to fix some minor issues in February. As of v0.52,...
Introducing Backutil: A Python‐based Windows backup utility
 -  Back in the spring, I decided that 2020 would be the year I would finally see a coding project through to completion. A recent work project shone a light on backup and recovery, and I realised that I should probably be a bit more consistent with my own backups from...
The best cyber security and technology books I read during 2020
 -  One of the few upsides of the whole 2020 situation is that I’ve had a lot more time to read. Periods that I would usually have spent commuting, out with friends, or cramming in chores between getting home and going to bed became downtime that I could devote to good...

Thinking about

Digital journalism
Coincidentally, in the space of a week I encountered both Zach Seward's article about Quartz and Craig Mod's excellent podcasts with Tim Ferriss. Both evoked fond memories of my time in journalism and the buzz surrounding digital journalism and media in the 2010s

Interests

  • Cyber security
  • Tech
  • Python
  • PowerShell
  • JavaScript
  • F1
  • Reading
  • Writing
  • Psychology
  • Philosophy
  • Exercise
  • Running
  • Gaming
  • Football
  • Music
  • Guitar