Posts tagged "incident-response"

• Investigating a real incident with the Amcache: walkthrough

  A fictional but realistic ransomware investigation, walked through the Amcache evidence end to end: the SHA-1 pivot, the corroboration, and the limits of the hive.

  2026-05-27