A personal DFIR blog by Andrew Prince. Notes, research, and lessons learned from a career spent chasing adversaries.https://forensicate.net/enhttps://forensicate.net/posts/ioc-recon/https://forensicate.net/posts/ioc-recon/Triaging indicators usually means the same tedious loop: copy an IP, paste it into VirusTotal, copy it again, paste it into your next source, then do the same for each domain, hash, and URL you're chasing. IOC Recon collapses that loop into a single right-click.Mon, 06 Jul 2026 00:00:00 GMTAndrew Princehttps://forensicate.net/posts/more-than-finding-evil/https://forensicate.net/posts/more-than-finding-evil/A common misconception about threat hunting is that its purpose is to surface adversaries hiding in your environment. That's one possible outcome, and in a healthy program, it's the rarest of the three.Mon, 20 Apr 2026 00:00:00 GMTthreat-huntingdetection-engineeringsocdefenseAndrew Princehttps://forensicate.net/posts/cbs-forensic-toolkit/https://forensicate.net/posts/cbs-forensic-toolkit/Parser for the Windows 11 Start Menu's CBS subsystem. Extracts forensic artifacts from the MicrosoftWindows.Client.CBS package: Start Menu search history, cached Bing queries, and application launch counts.Fri, 10 Apr 2026 00:00:00 GMTAndrew Princehttps://forensicate.net/posts/powershell-incident-response-cheatsheet/https://forensicate.net/posts/powershell-incident-response-cheatsheet/Quick-reference PowerShell commands for triage and evidence collection during live-response investigations.Thu, 31 Jul 2025 00:00:00 GMTpowershellincident-responsecheatsheetAndrew Princehttps://forensicate.net/posts/windows-event-ids-for-incident-response/https://forensicate.net/posts/windows-event-ids-for-incident-response/A working reference of the Windows event IDs of interest during triage, grouped by the investigative question they answer.Mon, 17 Mar 2025 00:00:00 GMTwindowsevent-logsincident-responsecheatsheetAndrew Princehttps://forensicate.net/posts/hello-world/https://forensicate.net/posts/hello-world/Welcome. If you're reading this, I'm online! I'm Andrew Prince, and this is my corner of the internet for writing about digital forensics and incident response. I've been meaning to stand up this blog for a while. Publishing notes privately…Mon, 03 Feb 2025 00:00:00 GMTmetaAndrew Prince