forensicsProeasy
Manager
duckerz
Task: Find the DriveName for a suspicious HarddiskVolume4 device in a Windows Event Log. Solution: Parse the EVTX file with python-evtx, search for events containing HarddiskVolume4, and extract the Volume GUID from the DriveName field in NTFS EventID 98 records.
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [forensics][Pro]:( (sad_face)— scarlet
- [web][Pro]Скрытая документация (Hidden Documentation)— duckerz
- [forensics][Pro]Дед Мороз забыл пароль (forgot_password)— hackerlab
- [forensics][Pro]Ищейка (Bloodhound)— duckerz
- [reverse][Pro]Защищенный банк (Protected Bank)— duckerz