Forrest Cook
@forrestcook.net
DFIR examiner, fighting the imposter syndrome one artifact at a time
Reposted by Forrest Cook
this would fix the website
April 28, 2026 at 4:47 PM
this would fix the website
I wonder how much it costs to hire those “phishing training” groups to target my IT department in a “Let’s see how you like it!” campaign. Just my disapproving face when they click the link.
April 29, 2026 at 1:27 PM
I wonder how much it costs to hire those “phishing training” groups to target my IT department in a “Let’s see how you like it!” campaign. Just my disapproving face when they click the link.
Looking to set this up on a MacBook Pro - never done VMs on a Mac before. Is one platform better than another to sandbox this utility?
MalChela 3.2: More Cowbell? More Intel!
One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations. A short while back, the author of mlget, xorhex, reached out and suggested I add…
One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations. A short while back, the author of mlget, xorhex, reached out and suggested I add…
MalChela 3.2: More Cowbell? More Intel!
One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations. A short while back, the author of mlget, xorhex, reached out and suggested I add more malware retrieval sources to FOSSOR, one of my earlier tools for pulling down samples from threat intel repositories.
bakerstreetforensics.com
April 27, 2026 at 5:30 PM
Looking to set this up on a MacBook Pro - never done VMs on a Mac before. Is one platform better than another to sandbox this utility?
Learning wordpress has become a part time job at this stage. One that costs me money. To think I used to code websites in notepad and I was happy about it. The interwebz got so complicated
#oldmanyellsatcloud #wordpress #blog #peoplestillblogright
#oldmanyellsatcloud #wordpress #blog #peoplestillblogright
August 28, 2025 at 2:45 AM
Learning wordpress has become a part time job at this stage. One that costs me money. To think I used to code websites in notepad and I was happy about it. The interwebz got so complicated
#oldmanyellsatcloud #wordpress #blog #peoplestillblogright
#oldmanyellsatcloud #wordpress #blog #peoplestillblogright
Don't show this to my boss. I think he already suspects it.
August 23, 2025 at 5:04 AM
Don't show this to my boss. I think he already suspects it.
Christian Peter took my small start, ran with it, and found the "finish line". There's always more work to be done, but he did what I intended on doing - completed an open source parser for Potato Chat. Check out his writeup here!
#dfir #ileapp #opensource #python
cp-df.com/en/blog/pota...
#dfir #ileapp #opensource #python
cp-df.com/en/blog/pota...
What's Taters, Precious? - Parsing Potato Chat with iLEAPP
What's Taters, Precious? - Parsing Potato Chat with iLEAPP
cp-df.com
August 23, 2025 at 5:01 AM
Christian Peter took my small start, ran with it, and found the "finish line". There's always more work to be done, but he did what I intended on doing - completed an open source parser for Potato Chat. Check out his writeup here!
#dfir #ileapp #opensource #python
cp-df.com/en/blog/pota...
#dfir #ileapp #opensource #python
cp-df.com/en/blog/pota...
New blog post... I'm sure I did everything right. I should post it on stack overflow and wait for the positive vibes.
forrestcook.net/2025/08/22/u...
#dfir #python #coding #github #tell_me_what_I_did_wrong_and_why_I_should_feel_bad
forrestcook.net/2025/08/22/u...
#dfir #python #coding #github #tell_me_what_I_did_wrong_and_why_I_should_feel_bad
Updating programs with duct tape, string and some hope
Graphic Loading… As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide …
forrestcook.net
August 23, 2025 at 4:57 AM
New blog post... I'm sure I did everything right. I should post it on stack overflow and wait for the positive vibes.
forrestcook.net/2025/08/22/u...
#dfir #python #coding #github #tell_me_what_I_did_wrong_and_why_I_should_feel_bad
forrestcook.net/2025/08/22/u...
#dfir #python #coding #github #tell_me_what_I_did_wrong_and_why_I_should_feel_bad
Updating programs with duct tape, string and some hope
Graphic Loading... As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide consistency to what was a messy and varied…
Graphic Loading... As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide consistency to what was a messy and varied…
Updating programs with duct tape, string and some hope
Graphic Loading... As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide consistency to what was a messy and varied approach by many in my area. Well, the program was something of a hit and many folks have been using it in their day to day.
forrestcook.net
August 23, 2025 at 4:52 AM
Updating programs with duct tape, string and some hope
Graphic Loading... As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide consistency to what was a messy and varied…
Graphic Loading... As I have written about previously, a warrant builder has been a personal pet project of mine for some time. I was intent on providing a simple way to streamline and provide consistency to what was a messy and varied…
Thanks for the resources! Love that this DFIR community is so helpful.
I followed the guides from @hacks4pancakes.com and @stark4n6.bsky.social in building my index for my first SANS class, hit a 96%. Two months ago me would have been happy with that, tonight me is grumpy about the three that got away.
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
July 30, 2025 at 4:08 AM
Thanks for the resources! Love that this DFIR community is so helpful.
I followed the guides from @hacks4pancakes.com and @stark4n6.bsky.social in building my index for my first SANS class, hit a 96%. Two months ago me would have been happy with that, tonight me is grumpy about the three that got away.
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
July 30, 2025 at 4:07 AM
I followed the guides from @hacks4pancakes.com and @stark4n6.bsky.social in building my index for my first SANS class, hit a 96%. Two months ago me would have been happy with that, tonight me is grumpy about the three that got away.
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
tisiphone.net/2015/08/18/g...
www.stark4n6.com/2020/11/gett...
@workchronicles.bsky.social - I feel this in my soul
Work Projects and Personal Projects - Work Chronicles
Work Chronicles is a light-hearted webcomic featuring funny, relatable and amusing tales from the modern-day office. Made with love & lots of coffee.
workchronicles.com
May 15, 2025 at 6:18 AM
@workchronicles.bsky.social - I feel this in my soul
The public release of my warrant builder just got an update. The particular agency/location/court variables are now taken from an easy to modify .json file. Self-contained executable (ARM and x64 versions available) so no python experience required. 🧵
#python #github #lawenforcement #nerdcop
#python #github #lawenforcement #nerdcop
May 9, 2025 at 5:46 PM
The public release of my warrant builder just got an update. The particular agency/location/court variables are now taken from an easy to modify .json file. Self-contained executable (ARM and x64 versions available) so no python experience required. 🧵
#python #github #lawenforcement #nerdcop
#python #github #lawenforcement #nerdcop
My daughter informed me this is how her beetles “poop”. Apparently the one on top is the one who is “pooping”. Learn something new everyday.
#bluedeathfeigningbeetles #beetle #bdfb #til
#bluedeathfeigningbeetles #beetle #bdfb #til
May 8, 2025 at 9:40 PM
My daughter informed me this is how her beetles “poop”. Apparently the one on top is the one who is “pooping”. Learn something new everyday.
#bluedeathfeigningbeetles #beetle #bdfb #til
#bluedeathfeigningbeetles #beetle #bdfb #til
#microcenter visit complete. Dear Lord I wish we had one of these in Arizona. Jam packed with ways to spend my money, I have some new toys to mess with now.
May 3, 2025 at 8:48 PM
#microcenter visit complete. Dear Lord I wish we had one of these in Arizona. Jam packed with ways to spend my money, I have some new toys to mess with now.
New post about a small standalone utility that I've been using to manually convert varints since the Winhex data interpreter doesn't do it for me. It's entirely possible there's another better utility out there, but it was faster for me to make this than continue to figure out how to search for it.
To Varint or not to varint
While working through the potato chat BLOBs, I was introduced to the varint concept. Effectively, a varint is a flexible way to communicate positive integers through one or more byte of data, dynamically. Instead of an application always requiring an integer use *one* byte of data to convey a number (and thus being limited from 0-255), or the application always requiring some larger number of bytes to convey a larger span of integers, a varint can be used.
forrestcook.net
April 21, 2025 at 2:43 AM
New post about a small standalone utility that I've been using to manually convert varints since the Winhex data interpreter doesn't do it for me. It's entirely possible there's another better utility out there, but it was faster for me to make this than continue to figure out how to search for it.
Clicking harder/louder also makes a difference.
April 18, 2025 at 4:23 PM
Clicking harder/louder also makes a difference.
Hot Potato in the blog! New post about Potato Chat, diving into some databases this time around.
Potato Chat 2, starchy boogaloo 🥔💬
In the last post I brought up some behaviors that I was able to test and observe within the potato chat application. While I am not done testing the application's behaviors (there are many... so many), I have also been attempting to process the various databases and logs to make some meaningful headway into documenting user activity through the app. The two main databases I have been working with are:
forrestcook.net
April 17, 2025 at 12:54 AM
Hot Potato in the blog! New post about Potato Chat, diving into some databases this time around.
April 7, 2025 at 4:40 PM
New post for the #dfir community! I've been working on parsing an unsupported app, would welcome feedback (or help) if you're so inclined! A follow-up is coming with BLOBs and Hex and Python (oh my!)
forrestcook.net/2025/04/04/p...
forrestcook.net/2025/04/04/p...
Potato Chat 🥔💬
I recently became aware of the “Potato Chat” application, which my tools weren’t supporting. I decided I would take a stab at parsing the unsupported elements from the various databases and log fil…
forrestcook.net
April 4, 2025 at 11:50 PM
New post for the #dfir community! I've been working on parsing an unsupported app, would welcome feedback (or help) if you're so inclined! A follow-up is coming with BLOBs and Hex and Python (oh my!)
forrestcook.net/2025/04/04/p...
forrestcook.net/2025/04/04/p...
Reposted by Forrest Cook
April 3, 2025 at 4:37 PM
Was trying to set up a Bambu A1 3d printer on my network recently... its seems almost intentionally bad. It'll connect to the LAN just fine, full bars. If I want to use the cloud service and check on things from my phone, however, it has been next to impossible to do.
#3dprinting #bambulabs
#3dprinting #bambulabs
March 27, 2025 at 5:20 PM
Was trying to set up a Bambu A1 3d printer on my network recently... its seems almost intentionally bad. It'll connect to the LAN just fine, full bars. If I want to use the cloud service and check on things from my phone, however, it has been next to impossible to do.
#3dprinting #bambulabs
#3dprinting #bambulabs
Was just talking about this to a class. Will continue bringing it up every class, we are letting data disappear with every delay and cannot know what we are losing. Preservation is vital.
Important must read position paper from Scientific Working Group on Digital Evidence (SWGDE) about the use of timely acquisition to preserve evidence. Mobile data has potential to degrade each day you wait to do an acquisition. #DFIR www.swgde.org/25-f-001/
www.swgde.org
March 12, 2025 at 3:24 PM
Was just talking about this to a class. Will continue bringing it up every class, we are letting data disappear with every delay and cannot know what we are losing. Preservation is vital.
Scheduled my Instagram for deletion - I'm sure the zuck will feel it in his wallet. Happy to not have meta or twitter in my life anymore though.
#deleteinstagram #deletetwitter #deletefacebook
#deleteinstagram #deletetwitter #deletefacebook
February 24, 2025 at 8:53 PM
Scheduled my Instagram for deletion - I'm sure the zuck will feel it in his wallet. Happy to not have meta or twitter in my life anymore though.
#deleteinstagram #deletetwitter #deletefacebook
#deleteinstagram #deletetwitter #deletefacebook
Love blog posts like this… great niche research that we get to reap the rewards from as we go forward.
www.doubleblak.com/blogPost.php...
#dfir
www.doubleblak.com/blogPost.php...
#dfir
DoubleBlak
www.doubleblak.com
January 11, 2025 at 10:33 PM
Love blog posts like this… great niche research that we get to reap the rewards from as we go forward.
www.doubleblak.com/blogPost.php...
#dfir
www.doubleblak.com/blogPost.php...
#dfir