Hands-on digital forensics and incident investigation.
Investigated Windows memory, corrupted and embedded files, version-control history, and application artifacts using repeatable evidence-analysis workflows across NCL and Hack The Box exercises.
Representative Work: NCL Fall 2026 · Hack The BoxMemory Forensics
Context: NCL Fall 2026 — The Book
Analyzed a Windows memory image using Volatility 3 and supporting tools to identify system information, locate file objects, recover a SQLite database from memory, and examine credential-related artifacts.
File Recovery & Signature Analysis
Context: NCL Fall 2026 — File Carving & Magic Bytes
Used file signatures, Binwalk, archive analysis, strings, and header inspection to identify misleading file types, locate embedded content, and recover hidden or altered data.
Representative Investigations
Version-Control Forensics
Context: NCL Fall 2026 — Version Control
Examined Git commit history and branches to recover metadata and historical content that was no longer visible in the current working files.
Application Artifact Investigation
Context: Hack The Box — Holmes CTF, Silent Dividend
Extracted an Electron application package, analyzed JavaScript artifacts, identified embedded application logic, and recreated a decoding process in Python to investigate concealed data.
Tools & Methods
Volatility 3 · SQLite3 · Binwalk · Git · file · strings · CyberChef · Python
Tools & Skills
Skills Demonstrated
Memory Forensics · File Carving · Artifact Analysis · Evidence Recovery · Embedded Data Analysis · Version-Control Forensics · Evidence Validation
Outcome: Applied repeatable forensic workflows to recover, correlate, and validate evidence across multiple investigation types.