https://alexsta-cybersecurity.com/field-notes/ Deep dives written for the person who has to do the work. en-US Wed, 30 Sep 2026 09:00:00 +0000 https://alexsta-cybersecurity.com/wp-content/uploads/2026/09/alexsta-icon-v2-150x150.png https://alexsta-cybersecurity.com/field-notes/ https://alexsta-cybersecurity.com/field-notes/usb-attached-not-usable/ https://alexsta-cybersecurity.com/field-notes/usb-attached-not-usable/ Wed, 30 Sep 2026 09:00:00 +0000 An external drive was plugged into a laptop 29 times, received a drive letter within five seconds and was opened in Explorer. For 15 hours nothing on it could be read. Every standard USB reference reads that laptop wrong, and on a data leakage case the wrong reading looks like exfiltration. https://alexsta-cybersecurity.com/field-notes/windows-feature-update-evidence/ https://alexsta-cybersecurity.com/field-notes/windows-feature-update-evidence/ Tue, 29 Sep 2026 09:00:00 +0000 An in-place feature update keeps the user's files, applications and profile, and replaces Windows underneath them. It rebuilds execution evidence and every event log, replays the user registry with its write times reset, and moves file-based activity across intact. Nothing looks missing afterwards. Everything simply starts on the upgrade day. https://alexsta-cybersecurity.com/field-notes/evidence-of-execution/ https://alexsta-cybersecurity.com/field-notes/evidence-of-execution/ Wed, 09 Sep 2026 23:20:17 +0000 Over the last decade I have run a lot of interviews for incident response roles. Each role puts the focus somewhere different, but for a SOC analyst one of the must-haves is knowing which sources carry evidence of execution. The answers I get are where this reference came from. https://alexsta-cybersecurity.com/field-notes/reading-linux-timestamps/ https://alexsta-cybersecurity.com/field-notes/reading-linux-timestamps/ Tue, 14 Mar 2023 09:00:00 +0000 Four letters, the same four you use on Windows, and almost every instinct you carry over is wrong. Most reads leave no trace in access time. Creation is not in the standard. The one field no timestamp interface can set is the one nobody looks at. https://alexsta-cybersecurity.com/field-notes/what-file-timestamps-mean/ https://alexsta-cybersecurity.com/field-notes/what-file-timestamps-mean/ Thu, 11 Jun 2020 09:00:00 +0000 The same four times are stored more than once, and only one copy can be reached by the documented API. That asymmetry is the tell. Knowing the benign explanation for every tell is the rest of the answer. https://alexsta-cybersecurity.com/field-notes/what-happens-when-a-file-is-deleted/ https://alexsta-cybersecurity.com/field-notes/what-happens-when-a-file-is-deleted/ Tue, 10 Dec 2019 09:00:00 +0000 The million dollar question of any DFIR interview, answered properly: every structure that changes, where the evidence survives, and the three places the standard answer is wrong.