Wrapping up 2025 with the year in code, including the evolution of MalChela for malware analysis, streamlined CyberPipe tools, and the introduction of Toby, a portable forensics platform. Focus was on creating practical solutions for #DFIR professionals and students for triage and #MalwareAnalysis

What a start…

CyberPipe-Timeliner was developed to integrate Magnet Response collections with ForensicTimeliner. This tool automates the workflow of EZTools, and transforms collection data into a unified forensic timeline. #DFIR

CyberPipe v5.3: Enhanced PowerShell Compatibility and Reliability I'm pleased to announce the release of CyberPipe v5.3, bringing critical compatibility improvements for Windows PowerShell 5.1 and enhanced reliability across all PowerShell environments. The Problem After releasing v5.2 with the…

You'll pry these Oxford commas out of my cold, dead, third thing hands

When you’re paranoid but any old tin foil hat won’t do. a.co/d/1GvRbfT

CyberPipe, a PowerShell script for digital evidence collection, has been updated with enhancements in collection, capabilities, and reliability. New features include intelligent collection with dual disk space validation, a QuickTriage profile, and improved BitLocker recovery. #DFIR

Swore I was reading @theonion.com

A trick and a treat this week with a quiet milestone for cross-platform DFIR tooling — MalChelaGUI now runs seamlessly inside Windows through Ubuntu WSL2, with zero configuration required. #DFIR #MalwareAnalysis

On Oct 8, join us for a special episode of #CyberUnpacked where hosts @dwmetz.bsky.social & Jeff Rutherford will bring together a panel of #DFIR leaders to explore top challenges investigative teams face and the state of #DigitalInvestigations today: ow.ly/jRVq50X2r0L

Masked ICE aren’t about safety; they’re about fear and evading responsibility. Demand transparency and accountability by adding your name to this petition:

In DFIR, reliable storage is essential for effective workflows. Crabwise, a USB benchmarking utility, addresses performance variability by calculating read and write speeds under direct conditions, bypassing caching and logs results for easy comparison. #DFIR

MalChela 3.0.2 introduces MITRE Lookup, a tool that allows forensic investigators to search the MITRE ATT&CK framework offline. This feature enhances investigation speed by supporting keyword and Technique ID searches while providing tactic categories and detection guidance. #DFIR #MalwareAnalysis

💙🐕 Toby ! :)

Toby-Find is a terminal-based tool designed for digital forensics, providing users with an easy way to discover command-line tools available in KALI and REMnux. It allows quick searches for tools, descriptions, and examples, enhancing usability in forensic analysis. #DFIR #MalwareAnalysis

🎯 MalChela v3.0.1 is live Sharper strings. Smarter signals. This update includes: ✅ Improved mstrings output and MITRE mappings 🧠 Smarter regex 🔎 Built-in MITRE technique lookup (GUI) 📁 FileMiner gets “select all” + subtool optimizations 🦀 Compiled for performance #DFIR #MalwareAnalysis

A MalChela 🦀 sighting in the wild

Portable Forensics with Toby: A Raspberry Pi Toolkit Toby is a compact, portable forensics toolkit built on a Raspberry Pi Zero 2 W, designed for ease of use in field analysis and malware triage. bakerstreetforensics.com/2025/07/20/p... #DFIR #MalwareAnalysis #RaspberryPi

Happy terrorize the dogs and veterans to all who celebrate.

Still a work in progress but very happy with my GaZendo (gazebo/zendo) so far…

If you’re working in #MalwareAnalysis I’d appreciate it if you gave MalChela a try and share your feedback. There’s a very comprehensive user guide to get started. github.com/dwmetz/MalCh...

MalChela v3.0 enhances investigative workflows by introducing cases for organization, replacing MismatchMiner with FileMiner for improved file analysis, and suggesting tools based on file characteristics, streamlining the analysis process. #MalChela #DFIR #MalwareAnalysis

Hashes for the Masses: Finding What Matters in a Sea of Samples #DFIR #MalwareAnalysis #Hash #MalChela

MalChela 2.2 “REMnux” Release More tools. More Docs. More Power. #DFIR #MalwareAnalysis #YaraX #Volatility #Tshark #MalChela

CyberPipe v5.1 is out with a few targeted improvements to make live response a bit smoother. Collection profiles can now be passed directly as arguments using -CollectionProfile. No need to modify the script or hardcode anything… bakerstreetforensics.com/2025/05/08/c... #DFIR

Teepublic was kind enough to arrange a 30% + discount on MalChela swag to coordinate with the new release. Head on over and grab yourself something while the sale lasts. ~14 hrs. to go #DFIR #MalwareAnalysis #Rust www.teepublic.com/t-shirt/7325...

🚀 MalChela v2.1 is now live! This update focuses on smoother workflows, better third-party tool integration, and more control for forensic analysts and malware researchers.

I’ve been working on improving the 3rd party integrations with MalChela (the updated release is coming soon). To really test the capabilities, I’ve been working through a bunch of the static analysis labs from FOR610.

If you’re on the fence about signing on to that @eff.org letter to support @thekrebscycle.bsky.social , please consider doing it sooner rather than later. Don’t wait until there’s no one left to speak for you. #RSAC2025 www.cnn.com/2025/04/30/p...

I recorded a brief video, walking through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing - all in minutes.

youtu.be/hI1EqojI1DA #DFIR #MalwareAnalysis #YARA #MITRE #Rust MalChela: github.com/dwmetz/MalCh...

You stood up for Mitnick. You stood up for Marcus Hutchins. You stood up for Anonymous. Aaron Swartz. Ed Snowden. Chelsea Manning. Ross Ulbricht. You stood up for them, regardless of whether you agreed with them. It was the right thing to do. Now it’s time to stand up for Chris Krebs.

It never ceases to amuse me when I wear this t-shirt and someone compliments it… then proceeds to tell me about their psychedelic experiences in the ‘80’s.

Sharing for the night crew. The MalChela YARA & Malware Analysis toolkit now has a GUI. But there’s much more than that. An updated fileanalyzer module, 15 new detections in mstrings and 3rd party tool integrations. GitHub: github.com/dwmetz/MalCh... Blog: bakerstreetforensics.com/2025/04/25/m...

PS: Looks great on REMnux. #DFIR #MalwareAnalysis

MalChela GUI: Visualizing Malware Analysis with Ease A New Face for MalChela MalChela, a Rust based toolkit for YARA and malware analysis, was released as a set of command-line apps just a few months ago. Now, it steps into a new realm with the introduction of a graphical user interface (GUI),…

Mining for Mismatches: Detecting Executables Disguised as Image Files #rust #dfir #MalwareAnalysis #YARA

On April 9, join us for a webinar where @dwmetz.bsky.social will explore a range of powerful, no-cost tools designed for efficient triage and memory acquisition in #DFIR workflows. Save your spot here: ow.ly/yn0x50VuHiR

Zen & the Art of Digital Forensics #DFIR #Zen

The 10th year of #MagnetUserSummit set a new bar! #MUS2025 was a special chance to learn more about #DFIR & Magnet Forensics products and truly gain an #InvestigativeEdge. Didn’t get a chance to join us in Nashville? Here are a few highlights: ow.ly/3rpG50VlHNR

MalChela Updates.. 🦀 It’s been a busy week. #DFIR #Rust #MalwareAnalysis bakerstreetforensics.com/2025/03/13/m...

For fun I decided to run mStrings against an old WannaCry sample. Network IOC results were spot on! github.com/dwmetz/MalCh... #DFIR #MalwareAnalysis #Rust #MalChela

Added a function to MalChela to check for available updates. But you have to update first before the update function works. 🤣 #MalwareAnalysis #Rust #DFIR

I’ve launched a new tool as part of Malchela, mStrings. It analyzes a file using Sigma rules defined in YAML, extracts strings and uses regular expressions to evaluate threats and align to MITRE ATT&CK techniques. #DFIR #MITRE #Sigma #MalwareAnalysis #Rust bakerstreetforensics.com/2025/03/09/m...

Introducing MalChela. A YARA and Malware Analysis utility written in Rust. #DFIR #MalwareAnalysis #YARA #Hashing

Seeing these scrips run brings me joy. #DFIR #MalwareAnalysis #Python #YARA

Creating custom hash sets with YARA and Python I don't like to brag, he said, but you should see the size of my malware library. For a recent project, I wanted to produce a hash set for all the malware files in my repository. Included in the library are malware samples for Windows and other…

Exploring Magnet Virtual Summit 2025 CTF Challenges, Part II (Windows) This is part II of this series; for part I see Exploring Magnet Virtual Summit 2025 CTF Challenges (iOS). If we jump into Axiom and head to the User Accounts, we can see that the SID for chick is…

Exploring Magnet Virtual Summit 2025 CTF Challenges (iOS) A couple weeks ago, I participated in the Magnet Virtual Summit 2025 CTF (Capture the Flag). While I don't think I will ever see a day where I win one of these, (speed is not my forte), I enjoyed working through a good number of the…

Overwhelming case load? A never ending queue of incidents? Need to reboot your mental health? Come join me at the Magnet Virtual Summit as I bring together two of my passions, Zen & the Art of Digital Forensics: Enhancing Insight Through Mindfulness. magnetvirtualsummit.com #DFIR #Zen