@beercow.bsky.social
"Distrust and caution are the parents of security." - Benjamin Franklin https://malwaremaloney.blogspot.com
I needed a way to password protect html reports, so I wrote one myself. github.com/Beercow/HTML...
GitHub - Beercow/HTMLcrypt: Password-Protected Self-Decrypting HTML Generator · GitHub
Password-Protected Self-Decrypting HTML Generator. Contribute to Beercow/HTMLcrypt development by creating an account on GitHub.
github.com
Combining Fuji Cartridge and WinFE into a single setup that can handle forensic imaging for both macOS and Windows systems. #DFIR malwaremaloney.blogspot.com/2026/04/last...
MALoney (It's in the name): Creating a Fuji/WinFE external drive
Creating a Fuji/WinFE external drive This post walks through how to build a combined Fuji Cartridge and ...
malwaremaloney.blogspot.com
SmackThatHash features AmCache SHA1 variant and QuickXorHash (OneDrive). Run against a single file or entire folder recursively. Pick from preset hashes or roll your own. Console and csv output. #DFIR github.com/Beercow/Smac...
GitHub - Beercow/SmackThatHash: Hashing utility including AmCache SHA1 and QuickXorHash · GitHub
Hashing utility including AmCache SHA1 and QuickXorHash - Beercow/SmackThatHash
github.com
Made an update to XstReader. It was unusable with larger ost files. It now loads large ost files in seconds making it usable again. Have a pull request in but not counting on it being accepted due to inactivity. Let me know what you think. #DFIR github.com/Beercow/XstR...
Releases · Beercow/XstReader
XstReader is an open source viewer for Microsoft Outlook’s .ost and .pst files (also those protected by unknown password). You can view and inspect all content and export messages and attachments (...
github.com
Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...
Fixed a bug in DeXRAY for Windows Defender files. 🙂 www.hexacorn.com/blog/2025/12...
📢 I partnered with @13cubed.bsky.social for another giveaway! 🎁 🏆 1 winner will receive a 13Cubed Investigator T-Shirt + the XPlat Bundle Complete 👕 5 winners will receive 13Cubed Investigator T-Shirts To Enter: Like, Comment, and Repost #DFIR #DigitalForensics #IncidentResponse
Not that kind of consent. The UAC kind of consent. Take a dive into how UAC works and some of the things it doesn’t tell you. Also a new utility to solve some of these issues. malwaremaloney.blogspot.com/2025/11/lets...
MALoney (It's in the name): Let's Talk About Consent
User Account Control (UAC) is one of Windows’ core security features, designed to prevent applications from silently gaini...
malwaremaloney.blogspot.com
When launching a program as admin, consent.exe runs with a parent process of svchost. If successful, consent.exe exits and the new process is launched with explorer as its parent. If not, we can’t always tell what was trying to be ran. Until now. github.com/Beercow/Cons...
When launching a program as admin, consent.exe runs with a parent process of svchost. If successful, consent.exe exits and the new process is launched with explorer as its parent. If not, we can’t always tell what was trying to be ran. Until now. github.com/Beercow/Cons...
Weekly update. New features in OneDriveExplorer, Onedrive Evolution and schema updates. #DFIR malwaremaloney.blogspot.com/2025/11/oned...
OneDrive updates
What's new in OneDriveExplorer OnedDriveExplorer v2025.11.07 now includes a dedicated parser for Microsoft.FilesOnDemand....
malwaremaloney.blogspot.com
Weekly update. New features in OneDriveExplorer, Onedrive Evolution and schema updates. #DFIR malwaremaloney.blogspot.com/2025/11/oned...
OneDrive updates
What's new in OneDriveExplorer OnedDriveExplorer v2025.11.07 now includes a dedicated parser for Microsoft.FilesOnDemand....
malwaremaloney.blogspot.com
Adding a parser for Microsoft.FilesOnDemand.db to OneDriveExplorer. Yet another source to rebuild the user’s OnDrive. More to come. #DFIR
Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...
MALoney (It's in the name): OneDrive Quick Access
What is Quick access? Quick access makes it simple to find your frequently used storage locations, inclu...
malwaremaloney.blogspot.com
Did a little digging in Microsoft.FileUsageSync.db. Found some information to piece together OneDrive Quick Access. #DFIR malwaremaloney.blogspot.com/2025/10/oned...
MALoney (It's in the name): OneDrive Quick Access
What is Quick access? Quick access makes it simple to find your frequently used storage locations, inclu...
malwaremaloney.blogspot.com
In case you missed it. New release of OneDriveExplorer. It has a dedicated parser for MicrosoftListSync.db (offline mode). #DFIR malwaremaloney.blogspot.com/2025/09/oned...
MALoney (It's in the name): OneDrive. Let's take this offline
At the beginning of this year, I started adding data from the offline databases into OneDrive Explorer. This data enhanced...
malwaremaloney.blogspot.com
That time of year again when everybody starts abbreviating cybersecurity awareness month as CSAM. 21 pages deep of google searches for that term and not a single mention of cybersecurity awareness month. Go figure.
OneDrive Evolution has been updated to v25.162.0820.0001. That’s 692 versions OneDriveExplorer now handles. SafeDelete.db has been updated to schema v9. Enjoy! malwaremaloney.blogspot.com/p/onedrive-e... malwaremaloney.blogspot.com/p/safedelete...
MALoney (It's in the name): OneDrive Evolution
Below is a collapsible indented tree depicting the contents of a OneDrive Profile. Each rectangle represents a file or directory and is lab...
malwaremaloney.blogspot.com
Appears OneDrive snuck a new sync client in. Works with personal accounts at the moment. It’s WebView2. You can find data in the following locations: AppData\Local\Microsoft\OneDrive\OD4 AppData\Local\Microsoft\OneDrive\Logs\OD4 Where are my browser forensics experts at? #DFIR
Updated OneDrive Evolution. You can now compare two versions of OneDrive and see what has changed. #DFIR malwaremaloney.blogspot.com/p/onedrive-e...
Something you may not know. OneDriveExplorer also works for the OneDrive sync client for macOS. github.com/Beercow/OneD...
Release v2025.05.30 · Beercow/OneDriveExplorer · GitHub
Change Log Fixed ODL bug fix FileUsageSynce bug fix
github.com
Today we learned Fishrocket (the one with the doughnut) has cancer. It’s an aggressive form of mast cell tumors. Treatment usually involves removing them but there are too many. They prescribe prednisone because they itch. Has diabetes so can’t give him prednisone. Poor guy.
1/ I successfully tested a LSASS dumping technique on a Windows 10 lab machine, which we encountered on a recent Incident Response engagement (no EDR, default Defender installed). The "MiniDumpWriteDump" technique, as described here [1], was successful in writing the LSASS process to disk.
