01 DFIRAPI Tracing with Frida 2026-10-0402 PWNClassic DLL Injection 2026-10-0303 DFIRDFIR GUI Tools 2026-09-2604 DFIRDisk & Memory Acquisition 2026-09-2605 DFIREric Zimmerman Tools & KAPE 2026-09-2606 DFIRETW as a Telemetry Source 2026-10-0407 TOOLFile Transfers 2026-08-0908 DFIRHandle Enumeration and Kernel Object Addresses 2026-10-0409 DFIRHunting Injected Threads 2026-10-0410 DFIRKernel Debugging Lab 2026-10-0411 DFIRKernel Notification Callbacks 2026-10-0412 FLOWNTFS Alternate Data Streams — Hiding & Finding Hidden Data 2026-09-2513 FLOWPotato Attacks — SeImpersonate to SYSTEM 2026-09-1714 PWNProcess Hollowing 2026-10-0315 DFIRRECmd Registry Forensics 2026-08-0916 DFIRSSDT and IDT 2026-10-0417 PWNStack-Based Buffer Overflow (Win x86) 2026-08-0918 DFIRstrings & File Triage 2026-09-2619 PWNThread Execution Hijacking 2026-10-0320 DFIRWalking the PEB and Comparing Image to Disk 2026-10-0421 TOOLWindows .NET Tooling on wine (NixOS) 2026-10-1322 TOOLWindows CMD & PowerShell 2026-08-0923 CREDWindows Credential & Flag Hunting 2026-09-2524 PRIVWindows Privilege Escalation 2026-09-1725 DFIRx64 Calling Conventions and Stack Frames 2026-10-04

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.