Andrea Fortuna
AboutRss
  • Apr 24, 2021

    “Unconventional Beauty”: 11 relaxing songs

    I’m still finishing up to write down all musical ideas that came in my mind during the covid-19 lockdown, and this new collection of songs is another part of them. 11 songs, more than 1 hours of relaxing (i hope!)… read more »
  • Apr 18, 2021

    How to sort and organize files recovered by PhotoRec

    During a forensic analysis, but also during other simple tasks (like helping a friend to recover deleted files), is useful to have a trusted tool to perform file-carving and data recovery. The tool that I prefer to perform this kind… read more »
  • Apr 10, 2021

    Android Triage: a really useful forensic tool by Mattia Epifani

    Most of forensic acquisition activities on an Android device can be accomplished using the ADB (Android Debug Bridge) tool. However, a lot of commands are required: luckily, the forensic expert Mattia Epifani created a bash script that automatize a lot… read more »
  • Apr 2, 2021

    How many data are shared by iOS and Android telemetry?

    An academic research, conducted by Professor Douglas J. Leith from Trinity College at the University of Dublin, analyzed traffic originating from iOS and Android devices heading to Apple and Google servers at various stages of a phone’s operation, such as… read more »
  • Mar 28, 2021

    “L’abbraccio più forte”, by Valerio Berruti

    On March 2020, the Italian artist Valerio Berruti launched the initiative “L’abbraccio più forte” ("The strongest embrace"), with which he undertook to donate one of his drawings to anyone who had made a donation of at least 300 euros to… read more »
  • Mar 27, 2021

    Didier Stevens: finding Metasploit & Cobalt Strike URLs

    An interesting article and video lesson by security reserarcher Didier Stevens. Cobalt Strike and Metasploit are the offensive security tools most commonly used to host malware command-and-control (C2) servers: both tool allows generation of shellcode for http(s) shells so, during… read more »
  • Mar 21, 2021

    “Inertial Damper”, my new electronic album, is out!

    Strange sounds, delays, reverbs, noises: 13 instrumental, synthetic, ethereal songs. Available today on all major music streaming services, such as Apple Music and Spotify: https://open.spotify.com/album/45ynm44gnBRb6wMdNS9w8V I hope you enjoy it! … read more »
  • Mar 13, 2021

    Coding on iPad Pro: my own setup

    Some months ago, my loved Thinkpad x1 carbon started to have some issues on battery and motherboard. It was an 8 years laptop, so i decided to directly buy a new device for my "personal purposes" (all devices for work… read more »
  • Mar 6, 2021

    Some useful tips about /dev/tcp

    Just some simple tips that I found very useful. Bash supports read/write operations on a pseudo-device file /dev/tcp/[host]/[port] [1]. Writing to this special file makes bash open a tcp connection to host:port, and this feature may be used for some useful… read more »
  • Feb 27, 2021

    How to reduce your Digital Footprint, part 1: Web Browsers and Extensions

    There is no 100% anonymity on the internet. Your Digital Footprint is everywhere on the web: it is in all the actions you do on keyboard and mouse, on every tap and swipe on our mobile phone. All the tools… read more »
  • Feb 20, 2021

    ‘Deja Vu’, the mistery song

    I often wake up in the morning with a melody in my head.It shouldn't be anything unusual, but in my case they are mostly original songs, which I transcribe and (when listenable) make available online. Over the years I have… read more »
  • Feb 13, 2021

    How to perform a digital forensic analysis using only free tools

    Currently, there are a lot of good forensics commercial tools, can be used to perform a whole dfir workflow. However, several analyst anche companies cannot afford the purchase of those (awesome) tools. For this reason, all my dfir tutorial are… read more »
  • Feb 6, 2021

    Windows registry Transaction Logs in forensic analysis

    During forensic anaysis, Windows registry data can be useful to discover malicious activity and to determine if and what data may have been stolen from a network. Many different types of data are present in the registry that can provide… read more »
  • Jan 26, 2021

    Karsten Hahn: fileless Ursnif/Gozy static analysis and unpacking

    The malware analyst Karsten Hahn recently published a very interesting video about the analysis of a sample of the well-known malware Ursnif. Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit… read more »
  • Jan 19, 2021

    “My piano didn't fit in the elevator!”, a piano album

    I mean no offense to real piano players but, despite I am a guitarist, I always loved the sound of piano. And ever since I started composing my music, most of my songs are written with the voice of a… read more »
  • Jan 11, 2021

    4 WhatsApp alternatives, focused on privacy

    The recent controversies related to new WhatsApp's Privacy Policy have lead many users to start looking for new alternatives. Actually, WhatsApp claims to provide end-to-end encryption [1], which is a great security feature. There are, however, several loopholes, on which… read more »
  • Jan 6, 2021

    How to detect Cobalt Strike Beacons using Volatility

    Recently I’ve already written about Cobalt Strike detection during forensics analysis. However, some followers asked my if it was possibile to perform this activities using Volatility, in order to integrate them in existing analysis workflows. Well, a solution has been… read more »
  • Dec 25, 2020

    “I'll Be Home for Christmas”, my Christmas single, is out!

    I think that music composition is very calming, then, during my Christmas holidays, I tried to relax as much as I could. Along with several songs started but never finished, I was able to complete a piece started exactly 1… read more »
  • Dec 23, 2020

    How to process recent Windows 10 memory dumps in Volatility 2

    Today I want to briefly take up a topic already addressed in a previous post: analysis of Windows 10 memory dumps using Volatility 2. In my previous article, I've recommended to use a FireEye's custom version of Volatility [1], with… read more »
  • Dec 21, 2020

    How to boot an Encase (E01) image using VirtualBox

    Sometimes, during an incident analysis, you may need to replicate behaviours of a specific host, perhaps already acquired with a forensic method. In order to perform this test, you first need to create a VM starting from a forensic image,… read more »
« Previous page Next page »

Andrea Fortuna

  • Andrea Fortuna
  • andrea@andreafortuna.org
  • andreafortuna
  • andreafortunaig
  • andrea-fortuna
  • andrea
  • andreafortunatw

Cybersecurity expert, software developer, experienced digital forensic analyst, musician