London, UK >  A cyber security professional observing technology, business, and culture with a skeptical – but never cynical – eye, and scratching a writing itch from a previous life as a journalist.

Recent blog posts

View all
Feed
2023: Thoughts on new challenges and sharing experiences
 -  A belated happy new year! If you’re reading this, I hope you have a terrific 2023. I recently went back and read some old posts that have long since been deleted from this blog - writings from my journalism days that reminded me of my perspectives...
Investigating Explorer's temporary ZIP folders and retrieving files
 -  If I was to describe how often malware is downloaded within ZIP archives, “common” would be a huge understatement. A key artefact in these investigations is the temporary directory Windows creates when a user opens an archive in Explorer, but I re...
Parsing login sessions from the Windows event log with PowerShell
 -  Faced with a day at home recovering from my most recent COVID-19 booster vaccine, I realised I hadn’t written anything more than a few lines of PowerShell in a while and decided to spend some time working on something interesting. The idea occurre...
Using Tkinter to build simple GUIs for Python apps
 -  I’ve written many Python scripts and apps in the past, including my Windows backup utility Backutil, which is probably the my most complex project to date. But I’ve always designed these to run in the background or on the command line, and haven’t...
Linux .bash_history: Basics, behaviours, and forensics
 -  During any incident investigation on a Linux system, one of the most valuable things for responders and forensicators to establish is which commands were run. This is key to finding out what an attacker or malicious user was attempting to do, and ...
SANS Holiday Hack Challenge 2021: Slot machine walkthrough
 -  Here’s one more writeup from the SANS Holiday Hack Challenge! The slot machine hack was one of the showpiece challenges this year, so I thought I’d put together a quick blog post to guide you through the process of identifying and exploiting a vul...
SANS Holiday Hack Challenge 2021: Yara rule analysis walkthrough
 -  Over the Christmas break I took part in an annual tradition - the SANS Holiday Hack Challenge! For 2021 the team had put together a fresh set of challenges for this festive CTF, and now that the deadline for submissions and subsequent embargo has ...
Backutil development: Implementing multiprocessing in Python
 -  I’m still hard at work on Backutil, my simple Windows backup utility with automatic rotation features, fitting in little tweaks and improvements around my daily schedule. The latest of these - and perhaps the most impactful in terms of performance...
Installing Splunk Free in a virtual machine for log analysis
 -  Splunk is considered the gold standard for analysis of event logs and other data, but unless you’re lucky enough to work for an organisation that pays for it, it can be difficult to get practical experience in how to run searches, build dashboards...
File carving: Recovering a deleted file from a Windows disk image
 -  Most computer users assume that when they delete a file and empty the Recycle Bin, it’s gone forever. After all, if Windows doesn’t show us a file, it doesn’t exist anymore, right? Wrong. With the right tools and knowledge, forensics experts can f...

📓

Field Notes newsletter

A monthly collection of observations, ideas in progress, and the best books, podcasts, and articles I discover

Categories

Index & pages

Blog index

Thinking about

Digital journalism
Coincidentally, in the space of a week I encountered both Zach Seward's article about Quartz and Craig Mod's excellent podcasts with Tim Ferriss. Both evoked fond memories of my time in journalism and the buzz surrounding digital journalism and media in the 2010s

Interests

  • Cyber security
  • Tech
  • Python
  • PowerShell
  • JavaScript
  • F1
  • Reading
  • Writing
  • Psychology
  • Philosophy
  • Exercise
  • Running
  • Gaming
  • Football
  • Music
  • Guitar