Phill Moore

Phill Moore

@phillmoore.bsky.social

805 followers 128 following106 posts

@phillmoore.bsky.social

Week 43 - 2026 #DFIR thisweekin4n6.com/2026/10/25/w...

thisweekin4n6.comWeek 43 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Hal Pomeranz at ‘Righteous IT’ mtt.sh – Mounting Linux I…

@phillmoore.bsky.social

Week 42 - 2026 #DFIR thisweekin4n6.com/2026/10/18/w...

thisweekin4n6.comWeek 42 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Burning Fridges, Cold Evidence: The French Sup…

@phillmoore.bsky.social

Week 41 - 2026 #DFIR thisweekin4n6.com/2026/10/11/w...

thisweekin4n6.comWeek 41 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Forensic Acquisition of MediaTek-Based Android…

@phillmoore.bsky.social

Week 40 - 2026 #DFIR thisweekin4n6.com/2026/10/04/w...

thisweekin4n6.comWeek 40 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Adam at Hexacorn The boring state of stalled timelines… …

@phillmoore.bsky.social

Week 39 - 2026 #DFIR thisweekin4n6.com/2026/09/27/w...

thisweekin4n6.comWeek 39 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Apple Biome Forensics: Artifacts, Locations, a…

@phillmoore.bsky.social

Week 38 - 2026 #DFIR thisweekin4n6.com/2026/09/20/w...

thisweekin4n6.comWeek 38 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Eoghan Casey and Francesco Servida at DFRWS Introducing …

@phillmoore.bsky.social

Week 37 - 2026 #DFIR thisweekin4n6.com/2026/09/13/w...

thisweekin4n6.comWeek 37 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Corporate Endpoint Triage: How It Works and Wh…

@phillmoore.bsky.social

Week 36 - 2026 #DFIR thisweekin4n6.com/2026/09/06/w...

thisweekin4n6.comWeek 36 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis ADF Solutions Finding Evidence After an App Is Deleted A…

@phillmoore.bsky.social

Are we going to stop calling it Amcache?? #DFIR thinkdfir.com/2026/09/04/a...

thinkdfir.comAre we going to stop calling it Amcache??I was poking around my system recently and noticed something that’s slightly different with the Amcache folder It looks like C:\windows\appcompat\programs now has a few more files than before! I’ve…

@phillmoore.bsky.social

Week 35 - 2026 #DFIR thisweekin4n6.com/2026/08/30/w...

thisweekin4n6.comWeek 35 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

@phillmoore.bsky.social

Week 34 - 2026 #DFIR thisweekin4n6.com/2026/08/23/w...

thisweekin4n6.comWeek 34 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

@phillmoore.bsky.social

Week 33 - 2026 #DFIR thisweekin4n6.com/2026/08/16/w...

thisweekin4n6.comWeek 33 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

@phillmoore.bsky.social

Week 32 - 2026 #DFIR thisweekin4n6.com/2026/08/09/w...

thisweekin4n6.comWeek 32 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

@phillmoore.bsky.social

Week 31 - 2026 #DFIR thisweekin4n6.com/2026/08/02/w...

thisweekin4n6.comWeek 31 – 2026At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

@phillmoore.bsky.social

Week 30 - 2026 #DFIR thisweekin4n6.com/2026/07/26/w...

thisweekin4n6.comWeek 30 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Eoghan Casey at DFRWS Adding Clarity to a Foundational C…

@phillmoore.bsky.social

Week 29 - 2026 #DFIR thisweekin4n6.com/2026/07/19/w...

thisweekin4n6.comWeek 29 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts …

@phillmoore.bsky.social

Week 28 - 2026 #DFIR thisweekin4n6.com/2026/07/12/w...

thisweekin4n6.comWeek 28 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi…

@phillmoore.bsky.social

Week 27 - 2026 #DFIR thisweekin4n6.com/2026/07/05/w...

thisweekin4n6.comWeek 27 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage 3 AI Prompts for More Conf…

@phillmoore.bsky.social

Week 26 - 2026 #DFIR thisweekin4n6.com/2026/06/28/w...

thisweekin4n6.comWeek 26 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts …

@phillmoore.bsky.social

Week 25 – 2026 #DFIR thisweekin4n6.com/2026/06/21/w...

thisweekin4n6.comWeek 25 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Dr. Neal Krawetz at ‘The Hacker Factor Blog’ TrustMark’s…

@phillmoore.bsky.social

Week 24 - 2026 #DFIR thisweekin4n6.com/2026/06/14/w...

thisweekin4n6.comWeek 24 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis F-Response F-Response Collect, X-Ways, and You Forensafe…

@phillmoore.bsky.social

Week 23 - 2026 #DFIR thisweekin4n6.com/2026/06/07/w...

thisweekin4n6.comWeek 23 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Emi Polito at Amped How To Investigate Video Evidence: W…

@phillmoore.bsky.social

Week 22 - 2026 #DFIR thisweekin4n6.com/2026/05/31/w...

thisweekin4n6.comWeek 22 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage DFIR+AI Primer: How to Com…

@phillmoore.bsky.social

Week 21 - 2026 #DFIR thisweekin4n6.com/2026/05/24/w...

thisweekin4n6.comWeek 21 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrea Fortuna PowerShell DFIR 2026: from MemPro…

@phillmoore.bsky.social

Week 20 - 2026 #DFIR thisweekin4n6.com/2026/05/17/w...

thisweekin4n6.comWeek 20 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett Why iOS and Android Handle GPS Di…

@phillmoore.bsky.social

Week 19 - 2026 #DFIR thisweekin4n6.com/2026/05/10/w...

thisweekin4n6.comWeek 19 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Chad Gish at Magnet Forensics Windows forensics:…

@phillmoore.bsky.social

Week 18 - 2026 #DFIR thisweekin4n6.com/2026/05/03/w...

thisweekin4n6.comWeek 18 – 2026If you’re organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Andrew Garrett A Digital Forensic View: How iOS …

@phillmoore.bsky.social

Week 17 - 2026 #DFIR thisweekin4n6.com/2026/04/26/w...

thisweekin4n6.comWeek 17 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

@phillmoore.bsky.social

While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to. We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper thinkdfir.com/2026/04/25/t... #DFIR

thinkdfir.comTrust but Verify: Amcache’s OriginalFilename Field Isn’t Always AccurateDuring an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper. Mostly this is a call for help, and an explanation of how to test! TLDR Sometimes AmC…

@phillmoore.bsky.social

Week 16 - 2026 #DFIR thisweekin4n6.com/2026/04/19/w...

thisweekin4n6.comWeek 16 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

@phillmoore.bsky.social

Week 15 - 2026 #DFIR thisweekin4n6.com/2026/04/12/w...

thisweekin4n6.comWeek 15 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

@phillmoore.bsky.social

Week 14 - 2026 #DFIR thisweekin4n6.com/2026/04/05/w...

thisweekin4n6.comWeek 14 – 2026Stop scaling headcount. Scale your SecOps.Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and respons…

@phillmoore.bsky.social

Week 13 - 2026 #DFIR thisweekin4n6.com/2026/03/29/w...

thisweekin4n6.comWeek 13 – 2026Offline AI—built for DFIRBelkaGPT saves you days of manual review and reporting:- Transcribes audio and video- Describes and classifies pictures- Searches for similar faces- Answers questions about…

@phillmoore.bsky.social

Week 12 - 2026 #DFIR thisweekin4n6.com/2026/03/22/w...

thisweekin4n6.comWeek 12 – 2026Mobile Forensics CheatsheetMobile devices track vast amounts of user activity—often a goldmine of forensic evidence:- Device information- Application usage- Bluetooth and Wi-Fi connections- …and ot…

@phillmoore.bsky.social

Week 11 - 2026 #DFIR thisweekin4n6.com/2026/03/15/w...

thisweekin4n6.comWeek 11 – 2026Belkasoft X v2.10: More Evidence. Less Manual Effort.- Acquisition support for 40+ new Android devices- Deeper artifact extraction from Discord, Snapchat, iOS Biome, and more- Magnet Axiom (.mfdb) …

@phillmoore.bsky.social

Week 10 - 2026 #DFIR thisweekin4n6.com/2026/03/08/w...

thisweekin4n6.comWeek 10 – 2026Try Belkasoft X with BelkaGPT—Free 30-Day TrialOne platform for computer, mobile, cloud, car, and drone forensics.- Support for 1,500+ artifact types out of the box- Advanced tools for data search,…

@phillmoore.bsky.social

Week 09 - 2026 #DFIR thisweekin4n6.com/2026/03/01/w...

thisweekin4n6.comWeek 09 – 2026Belkasoft X v2.10 Is Here—With Smarter AI Assistant- BelkaGPT now holds context—ask follow-up questions without restating your query- Import Magnet Axiom (.mfdb) cases directly for AI analysis- Sim…

@phillmoore.bsky.social

Week 08 - 2026 #DFIR thisweekin4n6.com/2026/02/22/w...

thisweekin4n6.comWeek 08 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Chamindu PushpikaScattered Spider Uncaged – The AB Projekt Blue Investigation Elcomsoft Pe…

@phillmoore.bsky.social

Week 07 - 2026 #DFIR thisweekin4n6.com/2026/02/15/w...

thisweekin4n6.comWeek 07 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Atola TechnologyMaster Your Drives with MultiDrive BerlaEstablishing Occupant Actions & Invo…

@phillmoore.bsky.social

Week 06 - 2026 #DFIR thisweekin4n6.com/2026/02/08/w...

thisweekin4n6.comWeek 06 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Chris at AskCleesDecrypting Threema4.db Mike Wilkinson at Cyber TriageConfiguring Your System fo…

@phillmoore.bsky.social

Week 05 - 2026 #DFIR thisweekin4n6.com/2026/02/01/w...

thisweekin4n6.comWeek 05 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. BerlaFinding Previous Locations Without Geolocation Data Forensafe Android CoverMe iOS Timezone …

@phillmoore.bsky.social

Week 04 - 2026 #DFIR thisweekin4n6.com/2026/01/25/w...

thisweekin4n6.comWeek 04 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Digital Forensics Myanmar Network Action Predictor (Browser Forensic) SSD Recovery, Limitation a…

@phillmoore.bsky.social

Week 03 - 2026 #DFIR thisweekin4n6.com/2026/01/18/w...

thisweekin4n6.comWeek 03 – 2026BerlaConnecting Occupants to Vehicles Through Device Data Damien AttoeA Forensic Look at the Grok Android App Oleg Afonin at Elcomsoft Browser Forensics in 2026: App-Bound Encryption and Live Triag…

@phillmoore.bsky.social

Week 02 - 2026 #DFIR thisweekin4n6.com/2026/01/11/w...

thisweekin4n6.comWeek 02 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Akash PatelCase Studies: Building Effective Timelines with Plaso (Log2Timeline) Christian Peter“Far over t…

@phillmoore.bsky.social

Week 01 - 2026 #DFIR thisweekin4n6.com/2026/01/04/w...

thisweekin4n6.comWeek 01 – 2026Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

@phillmoore.bsky.social

Week 52 - 2025 #DFIR thisweekin4n6.com/2025/12/28/w...

thisweekin4n6.comWeek 52 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

@phillmoore.bsky.social

Week 51 - 2025 #DFIR thisweekin4n6.com/2025/12/21/w...

thisweekin4n6.comWeek 51 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

@phillmoore.bsky.social

Week 50 - 2025 #DFIR thisweekin4n6.com/2025/12/14/w...

thisweekin4n6.comWeek 50 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

@phillmoore.bsky.social

Week 49 - 2025 #DFIR thisweekin4n6.com/2025/12/07/w...

thisweekin4n6.comWeek 49 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

@phillmoore.bsky.social

Week 48 - 2025 #DFIR thisweekin4n6.com/2025/11/30/w...

thisweekin4n6.comWeek 48 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…