DFIR — DÆMON//SEC

01^:1 sheet

Acquisition

01 intermediateDisk & Memory Acquisition 2026-09-26

02^:2 sheets

Analysis

01 intermediateDFIR GUI Tools 2026-09-26 02 intermediatestrings & File Triage 2026-09-26

03^:1 sheet

Linux

01 advancedLinux Forensics 2026-09-26

04^:4 sheets

Other

01 intermediateDigital Forensics 2026-08-09 02 advancedRECmd Registry Forensics 2026-08-09 03 intermediateTShark 2026-08-09 04 advancedVolatility 3 2026-08-09

05^:1 sheet

Windows

01 advancedEric Zimmerman Tools & KAPE 2026-09-26

06^:9 sheets

Windows Internals

01 intermediateAPI Tracing with Frida 2026-10-04 02 intermediateETW as a Telemetry Source 2026-10-04 03 advancedHandle Enumeration and Kernel Object Addresses 2026-10-04 04 advancedHunting Injected Threads 2026-10-04 05 advancedKernel Debugging Lab 2026-10-04 06 advancedKernel Notification Callbacks 2026-10-04 07 advancedSSDT and IDT 2026-10-04 08 advancedWalking the PEB and Comparing Image to Disk 2026-10-04 09 advancedx64 Calling Conventions and Stack Frames 2026-10-04

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.