Masked ICE aren’t about safety; they’re about fear and evading responsibility. Demand transparency and accountability by adding your name to this petition:

In DFIR, reliable storage is essential for effective workflows. Crabwise, a USB benchmarking utility, addresses performance variability by calculating read and write speeds under direct conditions, bypassing caching and logs results for easy comparison. #DFIR

MalChela 3.0.2 introduces MITRE Lookup, a tool that allows forensic investigators to search the MITRE ATT&CK framework offline. This feature enhances investigation speed by supporting keyword and Technique ID searches while providing tactic categories and detection guidance. #DFIR #MalwareAnalysis

💙🐕 Toby ! :)

Toby-Find is a terminal-based tool designed for digital forensics, providing users with an easy way to discover command-line tools available in KALI and REMnux. It allows quick searches for tools, descriptions, and examples, enhancing usability in forensic analysis. #DFIR #MalwareAnalysis

🎯 MalChela v3.0.1 is live Sharper strings. Smarter signals. This update includes: ✅ Improved mstrings output and MITRE mappings 🧠 Smarter regex 🔎 Built-in MITRE technique lookup (GUI) 📁 FileMiner gets “select all” + subtool optimizations 🦀 Compiled for performance #DFIR #MalwareAnalysis

A MalChela 🦀 sighting in the wild

Portable Forensics with Toby: A Raspberry Pi Toolkit Toby is a compact, portable forensics toolkit built on a Raspberry Pi Zero 2 W, designed for ease of use in field analysis and malware triage. bakerstreetforensics.com/2025/07/20/p... #DFIR #MalwareAnalysis #RaspberryPi

Happy terrorize the dogs and veterans to all who celebrate.

Still a work in progress but very happy with my GaZendo (gazebo/zendo) so far…

If you’re working in #MalwareAnalysis I’d appreciate it if you gave MalChela a try and share your feedback. There’s a very comprehensive user guide to get started. github.com/dwmetz/MalCh...

MalChela v3.0 enhances investigative workflows by introducing cases for organization, replacing MismatchMiner with FileMiner for improved file analysis, and suggesting tools based on file characteristics, streamlining the analysis process. #MalChela #DFIR #MalwareAnalysis

Hashes for the Masses: Finding What Matters in a Sea of Samples #DFIR #MalwareAnalysis #Hash #MalChela

MalChela 2.2 “REMnux” Release More tools. More Docs. More Power. #DFIR #MalwareAnalysis #YaraX #Volatility #Tshark #MalChela

CyberPipe v5.1 is out with a few targeted improvements to make live response a bit smoother. Collection profiles can now be passed directly as arguments using -CollectionProfile. No need to modify the script or hardcode anything… bakerstreetforensics.com/2025/05/08/c... #DFIR

Teepublic was kind enough to arrange a 30% + discount on MalChela swag to coordinate with the new release. Head on over and grab yourself something while the sale lasts. ~14 hrs. to go #DFIR #MalwareAnalysis #Rust www.teepublic.com/t-shirt/7325...

🚀 MalChela v2.1 is now live! This update focuses on smoother workflows, better third-party tool integration, and more control for forensic analysts and malware researchers.

I’ve been working on improving the 3rd party integrations with MalChela (the updated release is coming soon). To really test the capabilities, I’ve been working through a bunch of the static analysis labs from FOR610.

If you’re on the fence about signing on to that @eff.org letter to support @thekrebscycle.bsky.social , please consider doing it sooner rather than later. Don’t wait until there’s no one left to speak for you. #RSAC2025 www.cnn.com/2025/04/30/p...

I recorded a brief video, walking through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing - all in minutes.

youtu.be/hI1EqojI1DA #DFIR #MalwareAnalysis #YARA #MITRE #Rust MalChela: github.com/dwmetz/MalCh...

You stood up for Mitnick. You stood up for Marcus Hutchins. You stood up for Anonymous. Aaron Swartz. Ed Snowden. Chelsea Manning. Ross Ulbricht. You stood up for them, regardless of whether you agreed with them. It was the right thing to do. Now it’s time to stand up for Chris Krebs.

It never ceases to amuse me when I wear this t-shirt and someone compliments it… then proceeds to tell me about their psychedelic experiences in the ‘80’s.

Sharing for the night crew. The MalChela YARA & Malware Analysis toolkit now has a GUI. But there’s much more than that. An updated fileanalyzer module, 15 new detections in mstrings and 3rd party tool integrations. GitHub: github.com/dwmetz/MalCh... Blog: bakerstreetforensics.com/2025/04/25/m...

PS: Looks great on REMnux. #DFIR #MalwareAnalysis

MalChela GUI: Visualizing Malware Analysis with Ease A New Face for MalChela MalChela, a Rust based toolkit for YARA and malware analysis, was released as a set of command-line apps just a few months ago. Now, it steps into a new realm with the introduction of a graphical user interface (GUI),…

Mining for Mismatches: Detecting Executables Disguised as Image Files #rust #dfir #MalwareAnalysis #YARA

On April 9, join us for a webinar where @dwmetz.bsky.social will explore a range of powerful, no-cost tools designed for efficient triage and memory acquisition in #DFIR workflows. Save your spot here: ow.ly/yn0x50VuHiR

Zen & the Art of Digital Forensics #DFIR #Zen

The 10th year of #MagnetUserSummit set a new bar! #MUS2025 was a special chance to learn more about #DFIR & Magnet Forensics products and truly gain an #InvestigativeEdge. Didn’t get a chance to join us in Nashville? Here are a few highlights: ow.ly/3rpG50VlHNR

MalChela Updates.. 🦀 It’s been a busy week. #DFIR #Rust #MalwareAnalysis bakerstreetforensics.com/2025/03/13/m...

For fun I decided to run mStrings against an old WannaCry sample. Network IOC results were spot on! github.com/dwmetz/MalCh... #DFIR #MalwareAnalysis #Rust #MalChela

Added a function to MalChela to check for available updates. But you have to update first before the update function works. 🤣 #MalwareAnalysis #Rust #DFIR

I’ve launched a new tool as part of Malchela, mStrings. It analyzes a file using Sigma rules defined in YAML, extracts strings and uses regular expressions to evaluate threats and align to MITRE ATT&CK techniques. #DFIR #MITRE #Sigma #MalwareAnalysis #Rust bakerstreetforensics.com/2025/03/09/m...

Introducing MalChela. A YARA and Malware Analysis utility written in Rust. #DFIR #MalwareAnalysis #YARA #Hashing

Seeing these scrips run brings me joy. #DFIR #MalwareAnalysis #Python #YARA

Creating custom hash sets with YARA and Python I don't like to brag, he said, but you should see the size of my malware library. For a recent project, I wanted to produce a hash set for all the malware files in my repository. Included in the library are malware samples for Windows and other…

Exploring Magnet Virtual Summit 2025 CTF Challenges, Part II (Windows) This is part II of this series; for part I see Exploring Magnet Virtual Summit 2025 CTF Challenges (iOS). If we jump into Axiom and head to the User Accounts, we can see that the SID for chick is…

Exploring Magnet Virtual Summit 2025 CTF Challenges (iOS) A couple weeks ago, I participated in the Magnet Virtual Summit 2025 CTF (Capture the Flag). While I don't think I will ever see a day where I win one of these, (speed is not my forte), I enjoyed working through a good number of the…

Overwhelming case load? A never ending queue of incidents? Need to reboot your mental health? Come join me at the Magnet Virtual Summit as I bring together two of my passions, Zen & the Art of Digital Forensics: Enhancing Insight Through Mindfulness. magnetvirtualsummit.com #DFIR #Zen

I was in a store this afternoon and after checking out one of the young men working there said “I’m sorry if this isn’t appropriate to say but” (as I waited with intrigue before he continued ) “you look like you make a really good Dungeon Master.”

#MagnetVirtualSummit starts in one hour! Join Jad Saliba & Braden Thomas as they address the tipping point of #DFIR in their keynote address: ow.ly/o2GR50UVWJi #MVS2025

The 2025 Magnet Virtual Summit kicks off today. Keynote is at 9am followed by a whole bunch of great content. My presentation “Unlocking DFIR: Free Tools for Triage and Acquisition” will be live at 1pm. Hope to see you there! #DFIR #InvestigativeEdge magnetvirtualsummit.com

#MVS2025 kicks off Monday! Be sure to save your spot for our keynote presentations, starting at 9:30AM ET with Magnet leadership and then we'll have Kevin Mulcahy up at 9:30AM ET. Then join us for our #CTF workshop and a new #MobileUnpacked: ow.ly/pM2n50UVLME #DFIR

bakerstreetforensics.com/2025/01/31/u... #DFIR #zen #Mindfulness #Forensics

I spent the better part of two and a half days building this wonderful #DnD #Lego set. At close to 3800 pieces it’s the largest I’ve done in a long time. The Beholder and the dragon are my favorites from the set. Next phase… LIGHTING.

I’ve taken a couple of Chris’s classes and they’re all top-notch. Even if you don’t win, you get the benefit of having donated to a worthy charity so it’s a win-win.

What a terrible tease. #Lego #Poe

Also, who would want a gov job after getting paid 300K at corporate? Man you are ignorant asf and don't understand my career progression at all. Anyway, what I like to do now is disrupt fuckfaces like you. Soon, I will automate even more of it. www.hackingbutlegal.com/p/disinforma...

I recently attended a virtual lock-picking instruction seminar. While I spent several years doing social engineering and physical penetration tests, ((what seems like eons ago,)) I never got into the realm of lock-picking. I really had a fun time with it and think I may have picked up a new hobby.

We are excited to announce that Medex, the trusted solution for authenticating media and countering manipulated content, is now part of the Magnet Forensics family! We are also pleased to share that Medex will now be known as #MagnetVerify. Learn more here: www.magnetforensics.com/blog/introdu...