US Securities and Exchange Commission Commissioner Hester Peirce has renewed her defense of crypto self-custody, calling it a basic freedom and pushing back against the growing idea that privacy in financial transactions is somehow suspicious.
Key Takeaways:
Hester Peirce says crypto self-custody is a basic freedom and people should not be forced to rely on intermediaries to hold their assets.
She argues that financial privacy should be the default and not treated as evidence of wrongdoing.
Her comments come as crypto legislation is delayed and ETFs pull some investors away from self-custody.
Speaking on The Rollup podcast, Peirce described herself as a “freedom maximalist” and argued that people should not be forced to rely on intermediaries to control their assets.
“Of course people can hold their own assets,” she said, questioning why that principle should even be controversial in a country founded on personal liberty.
SEC’s Peirce Says Financial Privacy Should Be the Default
Peirce also took aim at what she described as a cultural shift toward treating financial privacy as a red flag. Instead, she said, privacy should be the default, not a sign of wrongdoing.
“If you want to keep your transactions private, the assumption shouldn’t be that you’re doing something illegal,” she said. “It should be the opposite.”
Her remarks arrive as uncertainty continues around US crypto legislation.
According to Senator Tim Scott, the Digital Asset Market Structure Clarity Act, a bill that addresses self-custody, anti-money laundering rules and the classification of digital assets, has been delayed until 2026.
SPECIAL EP: America's Crypto Regulatory Reset with SEC Commissioner @HesterPeirce.
Rob and Andy interviewed @SECGov Commissioner Hester Peirce about why 2025 marks the line in the sand for crypto regulation in America.
The lull has left the industry without a legal framework that directly addresses how Americans can legally hold and use digital assets.
Peirce’s comments also come at a time when self-custody itself faces competition from Wall Street products.
Spot Bitcoin exchange-traded funds have made crypto easier to access for traditional investors, drawing some users away from holding coins directly in private wallets.
Self-Custodied Bitcoin Falls for First Time in 15 Years
Dr. Martin Hiesboeck, head of research at Uphold, said the industry is seeing the “first decline in self-custodied Bitcoin in 15 years,” as investors shift into ETFs for tax advantages and convenience.
The introduction of in-kind redemptions earlier this year allows ETF holders to swap crypto for shares without triggering a taxable event, a benefit that directly competes with personal wallets.
The real reason for all the whale movements out of self-custody is simple: taxes.
We are witnessing the first decline in self-custodied Bitcoin in 15 years.
BlackRock's iShares spot Bitcoin ETF (IBIT) has facilitated over $3 billion worth of Bitcoin conversions from whales.… pic.twitter.com/yepXRbLozM
The debate intensified in February when analyst PlanB disclosed that he had moved his Bitcoin into ETFs to avoid the stress of managing private keys.
He claimed that ETFs offer a convenient alternative, reducing the complexities and risks associated with holding private wallet keys.
One of the key reasons behind PlanB’s decision is the security challenge of managing private keys. “Not having to hassle with keys gives me peace of mind,” he stated.
The announcement sparked backlash from purists who see centralized custody as a betrayal of Bitcoin’s founding principles.
Security failures have shaped the crypto industry for more than a decade, making reliable custody solutions essential for businesses managing large digital asset holdings.
Bitcoin has finally broken above the $90,000 mark after days of struggling to reclaim this key psychological level. The move comes during a period of sharp volatility and persistent selling pressure that continues to dominate market sentiment.
Analysts remain divided, but a growing number are calling for the official start of a bear market as BTC trades nearly 30% below its all-time high and fails to establish a convincing recovery structure. Fear remains elevated, and confidence among both retail and institutional investors is weakening.
Adding to the uncertainty, new data from Arkham reveals that SpaceX transferred out another 1,163 BTC—worth approximately $105.23 million—just a few hours ago. The transfer appears to have been routed to Coinbase Prime, suggesting a potential custody shift by the company. Such large movements often spark concern in the market, as they may signal repositioning, selling preparation, or treasury adjustments by major corporate holders.
While Bitcoin’s push above $90K provides temporary relief, it does little to change the broader narrative: the market remains under pressure, liquidity is thinning, and macro-driven uncertainty continues to shape price action. The coming sessions will determine whether BTC can build momentum or slip back into deeper correction territory.
SpaceX’s Bitcoin Movements Add New Layer of Market Uncertainty
According to data from Arkham, SpaceX currently holds 6,095.45 BTC, valued at roughly $550 million at today’s prices. This substantial treasury position places the company among the larger corporate Bitcoin holders, and its recent on-chain activity has quickly drawn attention across the market.
The latest transfer—1,163 BTC moved just hours ago—marks a meaningful shift in activity for SpaceX, especially considering the company has been largely inactive in terms of BTC movements for months.
Arkham reports that this is SpaceX’s first notable transaction since October 29, when the company transferred 281 BTC to a new wallet address. While the motives behind these transfers remain unknown, traders typically monitor such moves closely, as large corporate holders can influence market sentiment.
Transfers to Coinbase Prime—as suspected in the latest movement—often suggest custody adjustments, treasury restructuring, or preparations for strategic repositioning.
For now, there is no clear indication that SpaceX is reducing its Bitcoin exposure. However, the renewed on-chain activity comes at a sensitive moment for the market, which is struggling with selling pressure, fear, and broad speculation about an emerging bear phase.
As long as major smart-money entities remain active, Bitcoin’s short-term direction may continue to experience heightened volatility.
Attempted Recovery but Still Under Pressure
Bitcoin is showing signs of recovery after plunging to new local lows last week, with the price now pushing back above $91,000. The chart shows a sharp bounce from the sub-$82,000 zone, which acted as a temporary support during the capitulation phase. However, despite this rebound, BTC remains below all major moving averages—the 50-day, 100-day, and 200-day—which reinforces the broader bearish structure.
The recent upswing reflects short-term relief rather than a confirmed trend reversal. Volume spiked heavily during the sell-off, indicating forced liquidations and panic selling. But the current bounce is happening on lighter volume, suggesting that buyers are cautious and not yet committing with strong conviction.
Structurally, Bitcoin must reclaim the $95,000–$98,000 zone, where the 50-day and 100-day moving averages converge.
This area represents the first major resistance cluster and will determine whether the market is transitioning into a recovery or simply forming a lower high before another leg down. Failure to break above this band could invite renewed selling pressure.
Featured image from ChatGPT, chart from TradingView.com
Today, we’re exploring mobile forensics, a field that matters deeply in modern crime investigations. Think about how much our phones know about us. They carry our contacts, messages, locations, and app history in many ways. They are a living log of our daily lives. Because they travel with us everywhere, they can be a goldmine of evidence when something serious happens, like a crime. In a murder investigation, for instance, a suspect’s or a victim’s phone can help us answer critical questions: Who were they in touch with right before the crime? Where did they go? What were they doing? What kind of money dealings were they involved in? All of this makes mobile forensics powerful for investigators. As digital forensic specialists, we use that data to reconstruct timelines, detect motives, and understand relationships. Because of this, even a seemingly small app on a phone might have huge significance. For example, financial trading apps may reveal risky behavior or debt. Chat apps might contain confessions or threats. Location logs might show the victim visiting unusual places.
The Difference Between Android and iOS Forensics
When we do mobile forensics, we usually see Android and iOS devices. These two operating systems are quite different under the hood, and that affects how we work with them. On Android, there’s generally more openness. The file system for many devices is more accessible, letting us examine data stored in app directories, caches, logs, and more. Because Android is so widespread and also fragmented with many manufacturers and versions, the data we can access depends a lot on the model and version.
On iOS, things are tighter. Apple uses its own file system (APFS), and there’s strong encryption, often backed by secure hardware. That means extracting data can be more challenging. Because of this, forensic tools must be very sophisticated to handle iOS devices.
When it comes to which has more usable data, Android often gives us more raw artifacts because of its flexibility. But iOS can also be very rich, especially when data is backed up to iCloud or when we can legally access the device in powerful ways.
The Tools For the Job
One of the most powerful tools is Cellebrite, which is used by law enforcement and digital forensic labs. Cellebrite’s tools are capable of extracting data from both Android and iOS devices, sometimes even from locked devices. But the ability to extract depends a lot on the device model, its security patch level, and how encrypted it is.
There’s an interesting twist when it comes to GrapheneOS, which is a very security-focused version of Android. According to reports, Cellebrite tools struggle more with GrapheneOS, especially on devices updated after 2022. In some cases, they may be able to do a “consent-based” extraction (meaning the phone has to be unlocked by the user), but they can’t fully bypass the security on a fully patched GrapheneOS phone. Because of that, from a security perspective, users are strongly encouraged to keep their firmware and operating system updated. Regular updates close vulnerabilities. Also, using strong passcodes, enabling encryption, and being careful about where sensitive data is stored can make a real difference in protecting personal data.
Our Case: Investigating a Murder Using an Android Phone
Now, let’s turn to our case. We are in the middle of a murder investigation, and we’ve managed to secure the victim’s Android phone. After talking with witnesses and people who were close to the victim, we believe this phone holds critical evidence. To analyze all of that, we are using ALEAPP, a forensic tool made specifically for parsing Android data.
ALEAPP and How It Works
ALEAPP stands for Android Logs, Events, And Protobuf Parser. It’s an open-source tool maintained by the forensic community. Basically, ALEAPP allows us to take the extracted data from an Android phone, whether it’s a logical extraction, a TAR or ZIP file, or a file-system dump and turn that raw data into a human-readable, well-organized report. ALEAPP can run through a graphical interface, which is very friendly and visual, or via command line, depending on how you prefer to work. As it processes data, it goes through different modules for things like call logs, SMS, app usage, accounts, Wi-Fi events, and more. In the end, it outputs a report, so you can easily explore and navigate all the findings.
We started by examining the internal storage of the Android device, especially the /data folder. This is where apps keep their private data, caches, and account information. Then, we prepared a separate place on our investigation workstation, a folder called output, where ALEAPP would save its processed data.
Once ALEAPP was ready, we launched it and pointed it to the extracted directories. We left all its parsing modules turned on so we wouldn’t miss any important artifact. We clicked “Process,” and depending on the size of the extracted data, we waited for a few minutes while ALEAPP parsed everything.
When the processing was done, a new folder appeared inside our output directory. In that folder, there was a file called index.html, that’s our main report. We opened it with a browser and the GUI showed us different categories. The interface is clean and intuitive, so even someone not deeply familiar with command-line tools can navigate it.
Evidence That Stood Out
One of the first things that caught our attention was a trading app. ALEAPP showed an installed application named OlympTrade. A quick web search confirmed that OlympTrade is a real online trading platform. That fits with what witnesses told us. The victim was involved in trading, possibly borrowing or investing money. We also noted a hash value for the app in our report, which helps prove the data’s integrity. This means we can be more confident that what we saw hasn’t been tampered with.
Next, we turned to text messages. According to the victim’s best friend’s testimony, the victim avoided some calls and said he owed a lot of money. When we checked SMS data in ALEAPP, we found a thread where the victim indeed owed $25,000 USD to someone.
We looked up the number in the contacts list, and it was saved under the name John Oberlander. That makes John an important person of interest in this investigation.
Then, we dove into location data. The victim’s family said that on September 20, 2023, he left his home without saying where he was going. In ALEAPP’s “Recent Activity” section, which tracks events like Wi-Fi connections, GPS logs, and other background activity, we saw evidence placing him at The Nile Ritz-Carlton in Cairo, Egypt. This is significant. A 5-star hotel, which could have security footage, check-in records, or payment logs. Investigators would almost certainly reach out to the hotel to reconstruct his stay.
The detective pressed on with his investigation and spoke with the hotel staff, hoping to fill in more of the victim’s final days. The employees confirmed that the victim had booked a room for ten days and was supposed to take a flight afterward. Naturally, the investigator wondered whether the victim had saved any ticket information on the phone, since many people store their travel plans digitally nowadays. Even though no tickets turned up in the phone’s files, the search did reveal something entirely different, and potentially much more important. We looked at Discord, since the app appeared in the list of installed applications. Discord logs can reveal private chats, plans, and sometimes illicit behavior. In this case, we saw a conversation indicating that the victim changed his travel plans. He postponed a flight to October 1st, according to the chat.
Later, he agreed to meet someone in person at a very specific place. It was the Fountains of Bellagio in Las Vegas. That detail could tie into motive or meetings related to the crime.
What Happens Next
At this stage, we’ve collected and parsed digital evidence, but our work is far from over. Now, we need to connect the phone-based data to the real world. That means requesting more information from visited places, checking for possible boarding or ticket purchases, and interviewing people named in the phone, like John Oberlander, or the person from Discord.
We might also want to validate financial trail through the trading platform (if we can access it legally), bank statements, or payment records. And importantly, we should search for other devices or backups. Maybe the victim had cloud backups, like Google Drive, or other devices that shed more light.
Reconstructed Timeline
The victim was heavily involved in trading and apparently owed $25,000 USD to John Oberlander. On September 20, 2023, he left his residence without telling anyone where he was headed. The phone’s location data places him later that day at The Nile Ritz-Carlton in Cairo, suggesting he stayed there. Sometime afterward, according to Discord chats, he changed his travel plans and his flight was rescheduled for October 1. During these chats, he arranged a meeting with someone at the Fountains of Bellagio in Las Vegas.
Summary
Mobile forensics is a deeply powerful tool when investigating crimes. A single smartphone can hold evidence that helps reconstruct what happened, when, and with whom. Android devices often offer more raw data because of their openness, while iOS devices pose different challenges due to their strong encryption. Tools like ALEAPP let us parse all of that data into meaningful and structured reports.
In the case we’re studying, the victim’s phone has offered us insights into his financial troubles, his social connections, his movements, and his plans. But digital evidence is only one piece. To solve a crime, we must combine what we learn from devices with interviews, external records, and careful collaboration with other investigators.
Our team provides professional mobile forensics services designed to support individuals, organizations, and legal professionals who need clear, reliable answers grounded in technical expertise. We also offer a comprehensive digital forensics course for those who want to build their own investigative skills and understand how evidence is recovered, analyzed, and preserved. And if you feel that your safety or your life may be at risk, reach out immediately. Whether you need guidance, assistance, or a deeper understanding of the digital traces surrounding your case, we are here to help.
Check out our Mobile Forensics training for more in-depth training
Paxos purchases an institutional wallet provider in a $100M deal.
The move leverages Fordefi’s MPC wallet for a regulated custody framework.
DeFi is increasingly becoming part of the mainstream monetary infrastructure.
Paxos, a reputable blockchain infrastructure company behind multiple stablecoins, confirmed the acquisition on Forderfi late on Tuesday.
While the firms didn’t reveal the transaction’s value, sources close to the matter suggest that the deal exceeds $100 million, reflecting one of the most aggressive and strategic expansions in recent years.
The team emphasized:
This strengthens our ability to support institutions with more flexible and sophisticated digital asset infrastructure.
For context, Fordefi is a thriving enterprise wallet and custody provider.
This acquisition comes as institutions are moving to on-chain operations at an unprecedented pace.
Companies exploring blockchain technology like tokenized assets, complex DeFi strategies, and stablecoin settlements are seeking secure, modular custody.
Paxos aims to satisfy this demand by merging its compliant custodial infrastructure with Fordefi’s policy-centered MPC (multi-party computation) wallet tech.
Commenting on the strategic purchase, Paxos co-founder and CEO Charles Cascarilla said:
Together, Paxos and Fordefi provide customers with a world-class custody solution built upon advanced wallet technology and regulated, qualified custody. We’re excited to welcome Fordefi to our team as we enter this new phase of growth.
Paxos enriches its enterprise playbook
Businesses venturing into the blockchain and crypto sectors have leveraged Paxos for compliant infrastructure and custody.
The firm maintains a high-end regulatory model, with supervision from Singapore’s MAS, the NYDFS in the US, Abu Dhabi’s FSRA, and FIN-FSA in Europe.
Moreover, its tokenization and stablecoin systems power fiscal settlements for leading companies, including MasterCard, Nubank, PayPal, and Interactive Brokers.
Now, Paxos is integrating Fordefi to offer its customers a unified platform that supports everything from asset tokenization and issuance to streamlined access to DeFi protocols.
CEO Cascarillar added:
Fordefi has built an impressive stack and customer base founded on easy-to-use APIs and seamless web3 connectivity. Market participants require a regulated platform partner that meets their range of complex custody needs.
The fast-growing Fordefi
Fordefi has grown into a reputable institutional wallet provider in the DeFi industry since its 2021 launch.
The platform boasts two crucial features.
First and foremost, Fordefi’s MPC-based address model reduced single-point failure risks.
On the other hand, the policy engines enable enterprises to handle compliance rules, risk management, and permissions across decentralized and centralized setups.
Fordefi currently secures over $120 billion in monthly transactions, supporting nearly 300 enterprises, including hedge funds, crypto-native companies, and trading desks.
Josh Schwartz, CEO of Fordefi, believes Paxos will heighten its reach while aligning with its primary missions. He said:
Fordefi has built a best-in-class wallet platform trusted by nearly 300 institutions. Joining Paxos allows us to bring our technology to an even broader audience while maintaining our focus on security, usability, and innovation. Together, we will offer enterprises the unified custody and stablecoin infrastructure they need to deploy real-world digital asset use cases at scale.
For now, Fordefi will operate independently as Paxos pursues a phased integration.
Lava, the Bitcoin-backed loans software company, sparked controversy among Bitcoin CEOs recently, after a series of announcements following a $200 million fundraise. The company, led by Shehzan Maredia, had previously been marketed as a self-custody wallet and platform, mirroring the functionality of DeFi or decentralized finance products. The new update to the Lava app changed the custody model to a fully custodial and trusted fintech platform, raising questions about the lending company’s legal status.
The announcement about the fund raise drew the attention of Bitcoin industry leaders, who raised questions about the nature of the investment and the implications of the change in custody model, which Shehzan confirmed in follow-up X posts.
“The security of our users and their funds is our top priority. Every change we’ve made is guided by that. Lava no longer uses DLCs — discrete log contracts — for loans because the technology doesn’t meet our security standards. Our team built the largest application using DLCs, but we discovered vulnerabilities that we weren’t comfortable having (ex., client-side key risk, hot keys).”
Shezhan added that “Risks we previously thought were impossible, such as thinking oracles couldn’t be manipulated to liquidate individual users, we figured out were possible in practice. We are unwilling to compromise on security for our users at any level, and we take a very holistic view on removing trust, dependencies, and counterparty risk.”
DLCs are a kind of Bitcoin smart contract that can anchor the spendability of a bitcoin balance to an external event, such as the price of bitcoin in dollar terms, through the use of a third-party “oracle”. Oracle-based decentralized finance technology (DeFi) was recently exploited, resulting in a 20 billion dollar liquidation event, specifically targeting Binance’s stablecoin orderbook.
Their previous technology, which Shehzan says is still used by users who did not choose to update to the new version of the software, gave end users cryptographic control over part of the account via 2 of 2 multi-signature DLC smart contracts, limiting how the Bitcoin put up by users as collateral could move.
Lava’s terms of service still claim — as of the time of writing — that the company has “no exclusive custody or control over the contents of your wallet and has no ability to retrieve or transfer its contents.” Yet this contradicts statements made by Shehzan in recent days regarding the company’s pivot to a cold storage custody model.
Despite Shehzan’s clarification and posts on X, critics were skeptical of the reasoning. Some users were alarmed at the fundamental change in the custody model, which caught many by surprise and was communicated poorly, if at all.
One user, Owen Kemeys of Foundation devices, wrote, “Did Lava get my informed consent?” sharing a series of screenshots of the app update messaging, which says nothing about the change in custody model.
Will Foxley of Blockspace media complained, “Why did they roll legacy loans over without contact first. Plus, how did they do this if it was DLCs? Did I sign a bunch of pre-signed transactions that gave them control over the entire loan?”
The pivot has also raised questions about the company’s regulatory status and licenses, as centralized and custodial bitcoin-backed loan providers are arguably regulated under more traditional frameworks. Such regulations tend not to apply to DeFi-style self-custody products, precisely because user funds remain under user control, rather than under the complete control of a third party. With trust custodial trust becoming the Lava model overnight, what regulatory status does the company fall under?
Jack Mallers, CEO of Strike — a competing Bitcoin company with a Bitcoin-backed loans product line and a market leader — questioned the move, particularly in terms of licensing, which Strike has been working to acquire for years:
“If they’re custodial, how is what they’re doing legal?
Strike has been acquiring licenses for years. You can’t just “flip a switch” from non-custodial to custodial and start offering brokerage, trading, or lending services. That’s unlicensed activity, and it’s very illegal.
What licenses does Lava actually have that allow them to do what they’re doing?”
Bitcoin Magazine has not independently verified Lava’s licensing status. When asked for comment on the legal strategy and status of Lava, Shezhan pointed Bitcoin Magazine to the company’s FAQ, which does not appear to address the questions directly at all.
The nature of the investment announced by Lava was also called into question last week, as Cory Klipsten, CEO of Swan — a likely competitor to Lava — has also been actively engaging the story, suggesting it is specifically a line of credit agreement rather than an equity-style VC investment into the company. When asked, Shehzan told Bitcoin Magazine, “we raised both venture and debt,” referring to the 200 million raise announcement, though he did not go into details.
While the story is still developing and mostly involves discussions and debate on Bitcoin Twitter, the drama highlights the high value Bitcoiners place on self-custody and the risk of closed-source crypto applications, which can be updated without proper transparency or information being delivered to users about how their capital is secured.
Welcome back, aspiring digital forensics investigators!
In the previous article we introduced Autopsy and noted its wide adoption by law enforcement, federal agencies and other investigative teams. Autopsy is a forensic platform built on The Sleuth Kit and maintained by commercial and community contributors, including the Department of Homeland Security. It packages many common forensic functions into one interface and automates many of the repetitive tasks you would otherwise perform manually.
Today, let’s focus on Autopsy and how we can investigate a simple case with the help of this app. We will skip the basics as we have previously covered it.
Analysis
Artifacts and Evidence Handling
Start from the files you are given. In this walkthrough we received an E01 file, which is the EnCase evidence file format. An E01 is a forensic image container that stores a sector-by-sector copy of a drive together with case metadata, checksums and optional compression or segmentation. It is a common format in forensic workflows and preserves the information needed to verify later that an image has not been altered.
Before any analysis begins, confirm that your working copy matches the original by comparing hash values. Tools used to create forensic images, such as FTK Imager, normally generate a short text report in the same folder that lists the image metadata and hashes you can use for verification.
Autopsy also displays the same hash values once the image is loaded. To see that select the Data Source and view the Summary in the results pane to confirm checksums and metadata.
Enter all receipts and transfers into the chain of custody log. These records are essential if your findings must be presented in court.
Opening Images In Autopsy
Create a new case and add the data source. If you have multiple EnCase segments in the same directory, point Autopsy to the first file and it will usually pick up the remaining segments automatically. Let the ingest modules run as required for your investigative goals, and keep notes about which modules and keyword searches you used so your process is reproducible.
Identifying The Host
First let’s see the computer name we are looking at. Names and labelling conventions can differ from the actual system name recorded in the image. You can quickly find the host name listed under Operating System Information, next to the SYSTEM entry.
Knowing the host name early helps orient the rest of your analysis and simplifies cross-referencing with network or domain logs.
Last Logins and User Activity
To understand who accessed the machine and when, we can review last login and account activity artifacts. Windows records many actions in different locations. These logs are extremely useful but also mean attackers sometimes attempt to use those logs to their own advantage. For instance, after a domain compromise an attacker can review all security logs and find machines that domain admins frequently visit. It doesn’t take much time to find out what your critical infrastructure is and where it is located with the help of such logs.
In Autopsy, review Operating System, then User Accounts and sort by last accessed or last logon time to see recent activity. Below we see that Sivapriya was the last one to login.
A last logon alone does not prove culpability. Attackers may act during normal working hours to blend in, and one user’s credentials can be used by another actor. You need to use time correlation and additional artifacts before drawing conclusions.
Installed Applications
Review installed applications and files on the system. Attackers often leave tools such as Python, credential dumpers or reconnaissance utilities on disk. Some are portable and will be found in Temp, Public or user directories rather than in Program Files. Execution evidence can be recovered from Prefetch, NTUSER.DAT, UserAssist, scheduled tasks, event logs and other sources we will cover separately.
In this case we found a network reconnaissance tool, Look@LAN, which is commonly used for mapping local networks.
Signed and legitimate tools are sometimes abused because they follow expected patterns and can evade simple detection.
Network Information and IP Addresses
Finding the IP address assigned to the host is useful for reconstructing lateral movement and correlating events across machines and the domain controller. The domain controller logs validate domain logons and are essential for tracing where an attacker moved next. In the image you can find network assignments in registry hives: the SYSTEM hive contains TCP/IP interface parameters under CurrentControlSet\Services\Tcpip\Parameters\Interfaces and Parameters, and the SOFTWARE hive stores network profile signatures under Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed and \Unmanaged or NetworkList
If the host used DHCP, registry entries may show previously assigned IPs, but sometimes the attacker’s tools carry their own configuration files. In our investigation we inspected an application configuration file (irunin.ini) found in Program Files (x86) and recovered the IP and MAC address active when that tool was executed.
The network adapter name and related entries are also recorded under SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards.
User Folders and Files
Examine the Users folder thoroughly. Attackers may intentionally store tools and scripts in other directories to create false flags, so check all profiles, temporary locations and shared folders. When you extract an artifact for analysis, hash it before and after processing to demonstrate integrity. In this case we located a PowerShell script that attempts privilege escalation.
The script checks if it is running as an administrator. If elevated it writes the output of whoami /all to %ALLUSERSPROFILE%\diag\exec_<id>.dat. If not elevated, it temporarily sets a value under HKCU\Environment\ProcExec with a PowerShell launch string, then triggers the built-in scheduled task \Microsoft\Windows\DiskCleanup\SilentCleanup via schtasks /run in the hope that the privileged task will pick up and execute the planted command, and finally removes the registry value. Errors are logged to a temporary diag file.
The goal was to validate a privilege escalation path by causing a higher-privilege process to run a payload and record the resulting elevated identity.
Credential Harvesting
We also found evidence of credential dumping tools in user directories. Mimikatz was present in Hasan’s folder, and Lazagne was also detected in Defender logs. These tools are commonly used to extract credentials that support lateral movement. The presence of python-3.9.1-amd64.exe in the same folder suggests the workstation could have been used to stage additional tools or scripts for propagation.
Remember that with sufficient privileges an attacker can place malicious files into other users’ directories, so initial attribution based only on file location is tentative.
Windows Defender and Detection History
If endpoint protection was active, its detection history can hold valuable context about what was observed and when. Windows Defender records detection entries can be found under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory*. Below we found another commonly used tool called LaZagne, which is available for both Linux and Windows and is used to extract credentials. Previously, we have covered the use of this tool a couple of times and you can refer to Powershell for Hackers – Basics to see how it works on Windows machines.
Correlate those entries with file timestamps, prefetch data and event logs to build a timeline of execution.
Zerologon
It was also mentioned that the attackers attempted the Zerologon exploit. Zerologon (CVE-2020-1472) is a critical vulnerability in the Netlogon protocol that can allow an unauthenticated attacker with network access to a domain controller to manipulate the Netlogon authentication process, potentially resetting a computer account password and enabling impersonation of the domain controller. Successful exploitation can lead to domain takeover.
Using keyword searches across the drive we can find related files, logs and strings that mention zerologon to verify any claims.
In the image above you can see NTUSER.DAT contains “Zerologon”. NTUSER.DAT is the per-user registry hive stored in each profile and is invaluable for forensics. It contains persistent traces such as Run and RunOnce entries, recently opened files and MRU lists, UserAssist, TypedURLs data, shells and a lot more. The presence of entries in a user’s NTUSER.DAT means that the user’s account environment recorded those actions. The entry appears in Sandhya’s NTUSER.DAT in this case, it suggests that the account participated in this activity or that artifacts were created while that profile was loaded.
Timeline
Pulling together the available artifacts suggests the following sequence. The first login on the workstation appears to have been by Sandhya, during which a Zerologon exploit was attempted but failed. After that, Hasan logged in and used tools to dump credentials, possibly to start moving laterally. Evidence of Mimikatz and a Python installer were found in Hasan’s directory. Finally, Sivapriya made the last recorded login on this workstation and a PowerShell script intended to escalate privileges was found in their directory. This script could have been used during lateral activity to escalate privileges on other hosts or if local admin rights were not assigned to Hasan, another attacker could have tried to escalate their privileges using Sivapriya’s account. At this stage it is not clear whether multiple accounts represent separate actors working together or a single hacker using different credentials. Resolving that requires cross-host correlation, domain controller logs and network telemetry.
Next Steps and Verification
This was a basic Autopsy workflow. For stronger attribution and a complete reconstruction we need to collect domain controller logs, firewall and proxy logs and any endpoint telemetry available. Specialised tools can be used for deeper analysis where appropriate.
Conclusion
As you can see, Autopsy is an extensible platform that can organize many routine forensic tasks, but it is only one part of a comprehensive investigation. Successful disk analysis depends on careful evidence handling and multiple data sources. It’s also important to confirm hashes and chain of custody before and after the analysis. When you combine solid on-disk analysis with domain and network logs, you can move from isolated observations to a defensible timeline and conclusions.
If you need forensic assistance, we offer professional services to help investigate and mitigate incidents. Additionally, we provide classes on digital forensics for those looking to expand their skills and understanding in this field.
If you’re diving into digital forensics, memory analysis is one of the most exciting and useful skills you can pick up. Essentially, you take a snapshot of what’s happening inside a computer’s brain right at that moment and analyze it. Unlike checking files on a hard drive, which shows what was saved before, memory tells you about live actions. Things like running programs or hidden threats that might disappear when the machine shuts down. This makes it super helpful for solving cyber incidents, especially when bad guys try to cover their tracks.
In this guide, we’re starting with the basics of memory analysis using a tool called Volatility. We’ll cover why it’s so important, how to get started, and some key commands to make you feel confident. This is part one, where we focus on the foundations and give instructions. Stick around for part two, where we’ll keep exploring Volatility and dive into network details, registry keys, files, and scans like malfind and Yara rules. Plus, if you make it through part two, there are some bonuses waiting to help you extract even more insights quickly.
Memory Forensics
Memory analysis captures stuff that disk forensics might miss. For example, after a cyber attack, malware could delete its own files or run without saving anything to the disk at all. That leaves you with nothing to find on the hard drive. But in memory, you can spot remnants like active connections or secret codes. Even law enforcement grabs memory dumps from suspects’ computers before powering them off. Once it’s off, the RAM clears out, and booting back up might be tricky if the hacker sets traps. Hackers often use tricks like USB drives that trigger wipes of sensitive data on shutdown, cleaning everything in seconds so authorities find nothing. We’re not diving into those tricks here, but they show why memory comes first in many investigations.
Lucky for us, Volatility makes working with these memory captures straightforward. It started evolving, and in 2019, Volatility 3 arrived with better syntax and easier to remember commands. We’ll look at both Volatility 2 and 3, sharing commands to get you comfortable. These should cover what most analysts need.
Memory Gems
Below is some valuable data you can find in RAM for investigations:
1. Network connections
2. File handles and open files
3. Open registry keys
4. Running processes on the system
5. Loaded modules
6. Loaded device drivers
7. Command history and console sessions
8. Kernel data structures
9. User and credential information
10. Malware artifacts
11. System configuration
12. Process memory regions
Keep in mind, sometimes key data like encryption keys hides in memory. Memory forensics can pull this out, which might be a game-changer for a case.
Approach to Memory Forensics
In this section we will describe a structured method for conducting memory forensics, designed to support investigations of data in memory. It is based on the six-step process from SANS for analyzing memory.
Identifying and Checking Processes
Start by listing all processes that are currently running. Harmful programs can pretend to be normal ones, often using names that are very similar to trick people. To handle this:
1. List every active process.
2. Find out where each one comes from in the operating system.
3. Compare them to lists of known safe processes.
4. Note any differences or odd names that stand out.
Examining Process Details
After spotting processes that might be problematic, look closely at the related dynamic link libraries (DLLs) and resources they use. Bad software can hide by misusing DLLs. Key steps include:
1. Review the DLLs connected to the questionable process.
2. Look for any that are not approved or seem harmful.
3. Check for evidence of DLLs being inserted or taken over improperly.
Reviewing Network Connections
A lot of malware needs to connect to the internet, such as to contact control servers or send out stolen information. To find these activities:
1. Check the open and closed network links stored in memory.
2. Record any outside IP addresses and related web domains.
3. Figure out what the connection is for and why it’s happening.
4. Confirm if the process is genuine.
5. See if it usually needs network access.
6. Track it back to the process that started it.
7. Judge if its actions make sense.
Finding Code Injection
Skilled attackers may use methods like replacing a process’s code or working in hidden memory areas. To detect this:
1. Apply tools for memory analysis to spot unusual patterns or signs of these tactics.
2. Point out processes that use strange memory locations or act in unexpected ways.
Detecting Rootkits
Attackers often aim for long-term access and hiding. Rootkits bury themselves deep in the system, giving high-level control while staying out of sight. To address them:
1. Search for indicators of rootkit presence or major changes to the OS.
2. Spot any processes or drivers with extra privileges or hidden traits.
Isolating Suspicious Items
Once suspicious processes, drivers, or files are identified, pull them out for further study. This means:
1. Extract the questionable parts from memory.
2. Save them safely for detailed review with forensic software.
The Volatility Framework
A widely recommended option for memory forensics is Volatility. This is a prominent open-source framework used in the field. Its main component is a Python script called Volatility, which relies on various plugins to carefully analyze memory dumps. Since it is built on Python, it can run on any system that supports Python.
Volatility’s modules, also known as plugins, are additional features that expand the framework’s capabilities. They help pull out particular details or carry out targeted examinations on memory files.
Frequently Used Volatility Modules
Here are some modules that are often used:
pslist: Shows the active processes.
cmdline: Reveals the command-line parameters for processes.
netscan: Checks for network links and available ports.
malfind: Looks for possible harmful code added to processes.
handles: Examines open resources.
svcscan: Displays services in Windows.
dlllist: Lists the dynamic-link libraries loaded in a process.
hivelist: Identifies registry hives stored in memory.
Installing Volatility 3 is quite easy and will require a separate virtual environment to keep things organized. Create it first before proceeding with the rest:
bash$ > python3 -m venv ~/venvs/vol3
bash$ > source ~/venvs/vol3
Now you are ready to install it:
bash$ > pip install volatility3
Since we are going to cover Yara rules in Part 2, we will need to install some dependencies:
Yara rules are important and they help you automate half the analysis. There are hundreds of these rules available on Github, so you can download and use them each time you analyze the dump. While these rules can find a lot of things, there is always a chance that malware can fly under the radar, as attackers change tactics and rewrite payloads.
Now we are ready to work with Volatility 3.
Plugins
Volatility comes with multiple plugins. To list all the available plugins do this:
bash$ > vol -h
Each of these plugins has a separate help menu with a description of what it does.
Memory Analysis Cheat Sheet
Image Information
Imagine you’re an analyst investigating a hacked computer. You start with image information because it tells you basics like the OS version and architecture. This helps Volatility pick the right settings to read the memory dump correctly. Without it, your analysis could go wrong. For example, if a company got hit by ransomware, knowing the exact Windows version from the dump lets you spot if the malware targeted a specific weakness.
In Volatility 2, ‘imageinfo‘ scans for profiles, and ‘kdbgscan‘ digs deeper for kernel debug info if needed. Volatility 3’s ‘windows.info‘ combines this, showing 32/64-bit, OS versions, and kernel details all in one and it’s quicker.
bash$ > vol -f Windows.vmem windows.info
Here’s what the output looks like, showing key system details to guide your next steps.
Process Information
As a beginner analyst, you’d run process commands to list what’s running on the system, like spotting a fake “explorer.exe” that might be malware stealing data. Say you’re checking a bank employee’s machine after a phishing attack, these commands can tell you if suspicious programs are active, and help you trace the breach.
‘pslist‘ shows active processes via kernel structures. ‘psscan‘ scans memory for hidden ones (good for rootkits). ‘pstree‘ displays parent-child relationships like a family tree. ‘psxview‘ in Vol 2 compares lists to find hidden processes.
Note that Volatility 2 wants you to specify the profile. You can find out the profile while gathering the image info.
This output lists processes with PIDs, names, and start times. Great for spotting outliers.
bash$ > vol -f Windows.vmem windows.psscan
Here, you’ll see a broader scan that might catch processes trying to hide.
bash$ > vol -f Windows7.vmem windows.pstree
This tree view helps trace how processes relate, like if a browser spawned something shady.
Displaying the entire process tree will look messy, so we recommend a more targeted approach with –pid
Process Dump
You’d use process dump when you spot a suspicious process and want to extract its executable for closer inspection, like with antivirus tools. For instance, if you’re analyzing a system after a data leak, dumping a weird process could reveal it is spyware sending info to hackers.
Vol 2’s ‘procdump‘ pulls the exe for a PID. Vol 3’s ‘dumpfiles‘ grabs the exe plus related DLLs, giving more context.
After the dump, check the output and analyze it further.
Memdump
Memdump is key for pulling the full memory of a process, which might hold passwords or code snippets. Imagine investigating insider theft, dumping memory from an email app could show unsent drafts with stolen data.
Vol 2’s ‘memdump’extracts raw memory for a PID. Vol 3’s ‘memmap’with –dump maps and dumps regions, useful for detailed forensics.
Here you see all loaded DLLs of this process. You already know how to dump processes with their DLLs for a more thorough analysis.
Handles
Handles show what a process is accessing, like files or keys crucial for seeing if malware is tampering with system parts. In a ransomware case, handles might reveal encrypted files being held open or encryption keys used to encrypt data.
Both commands list handles for a PID. Similar outputs, but Vol 3 is streamlined.
Services scan lists background programs, helping find persistent malware disguised as services. If you’re probing a server breach, this could uncover a backdoor service.
Use | more to page through long lists. Outputs are similar, showing service names and states.
Volatility 2:
vol -f “/path/to/file” ‑‑profile <profile> svcscan | more
Volatility 3:
vol -f “/path/to/file” windows.svcscan | more
Since this technique is often abused, a lot can be discovered here:
bash$ > vol -f Windows7.vmem windows.svcscan
Give it a closer look and spend enough time here. It’s good to familiarize yourself with native services and their locations
Summary
We’ve covered the essentials of memory analysis with Volatility, from why it’s vital to key commands for processes, dumps, DLLs, handles, and services. Apart from the commands, now you know how to approach memory forensics and what actions you should take. As we progress, more articles will be coming where we practice with different cases. We already have a memory dump of a machine that suffered a ransomware attack, which we analyzed with you recently. In part two, you will build on this knowledge by exploring network info, registry, files, and advanced scans like malfind and Yara rules. And for those who finish part two, some handy bonuses await to speed up your work even more. Stay tuned!
We continue our practical series on digital forensics and will look at the memory dump of a Windows machine after a ransomware attack. Ransomware incidents are common, although they may not always be the most profitable attacks because they require a lot of effort and stealth. Some operations take months of hard work and sleepless nights and still never pay off. Many attackers prefer to steal data and sell it on the dark web. Such data sells well and quickly. State sponsored APTs act similarly. Their goal is to stay silent and extract as much intelligence as possible.
Today, a thousand unique entries of private information of Russian citizens cost about $100. That’s cheap. But it also shows how effective Ukrainian and foreign hackers are against Russia. All this raises demand for digital forensics and incident response, since fines for data leaks can be enormous. It’s not only fines that are a threat. Reputation damage is critical. If your competitor has never, at least yet, experienced a data breach and you did and it went public, trust in your company will start crumbling and customers will be inclined to use your competitors’ services. An even worse scenario is a ransomware attack that locks down much of your organization and wipes out your backups. Paying the attackers gives no guarantee of recovering your data, and some companies never manage to recover at all.
So let’s investigate one of those attacks and learn something new to stay sharp.
Memory Analysis
It all begins with a memory dump. Here we already have a memory dump file of an infected machine that we are going to inspect.
Installing Volatility
On our Kali machine we created a new Python virtual environment for Volatility. Keeping separate environments is good practice because it prevents tools from interfering with other dependencies. Sometimes installing one tool can break another. Here is how you do it:
bash$ > python3 -m venv env_name
bash$ > source env_name/bin/activate
Now we are ready to install Volatility in this environment:
bash$ > pip3 install volatility3
It is also good practice to record the exact versions of Volatility and Python you used (for example, pip3 show volatility3 and python3 --version). Memory forensics tools change over time and some plugins behave slightly differently between releases. Recording versions makes your work reproducible later.
Image Information
One of the first things we look at after receiving a memory dump is the captured metadata. The Volatility 3 command is simple:
bash$ vol -f infected.vmem windows.info
When you run windows.info, inspect the OS build, memory size, and timestamps shown by the capture tool. That OS build value helps Volatility pick the correct symbol tables. Incorrect symbols can cause missing or malformed output. This is especially important if you are working with Volatility 2. Also confirm the capture method and metadata such as who made the capture, when, and whether the capture was acquired after isolating the machine. Recording this chain-of-custody metadata is a small step that greatly strengthens any forensic report.
Processes
The goal of the memory dump is to preserve processes, injections, and shellcode before they disappear after a reboot. That means we need to focus on the processes that existed at capture time. Let’s list them all:
bash$ > vol -f infected.vmem windows.pslist
Suspicious processes are not always easy to spot. It depends on the attacker’s tactics. Ransomware processes, unlike persistence mechanisms, are often obvious because attackers tend to pick violent or alarming names for encryptors. But that’s not always the case, so let’s give our image a closer look.
Among other processes, a ransomware process sticks out. You may also notice or4qtckT.exe and other processes with unknown names. Random executable names are not definitive proof of maliciousness, but they’re a reliable starting point for closer inspection. Some legitimate software may also generate processes with random names, for example, Dr.Web, a Russian antivirus.
When a process name looks random, check several things: the process parent, the process start time (did it start right before the incident?), open network sockets, loaded DLLs, and whether the executable exists on disk or only in memory. Processes that only exist in the RAM image (no matching file on disk) often indicate in-memory unpacking or fileless behavior. These are important signals in malware analysis. Use plugins like windows.psscan(process scan) to find processes that pslistmight miss and windows.pstree to visualize parent/child relationships. Also check windows.dlllistto see suspicious DLLs loaded into a process. Injected code often pulls suspicious DLL names or shows unnatural memory protections on executable pages.
Parent Relationships
Once you find malware, your next step is to find its parent. A parent is the process that launches another process. This is how you unravel the attack by going back in the timeline. windows.pslist has two important columns: PID (process ID) and PPID (parent process ID). The parent of WanaDecryptor has PID 2732. We can quickly search and find it.
Now we know that the process with a random name or4qtckT.exeinitiated WanaDecryptor. As it might not be the only process initiated by that parent, let’s grep its PID and find out:
The parent process can show how the attacker entered the machine. It might be a user process opened by a phishing email, a scheduled task that ran at an odd hour, or a system service that got abused. Tracing parents helps you decide whether this was an interactive compromise (an attacker manually ran something) or an automated spread. If you see network-facing services as parents or child processes that match known service names (for example, svchost.exe variants), dig deeper. Some ransomware uses service abuse, scheduled tasks, or built-in Windows mechanisms to reach higher privileges or persistence.
Handles
In Windows forensics, when we say we are “viewing the handles of a process,” we mean examining the internal references that a process has opened to system resources. A handle in Windows is essentially a unique identifier (a number) that a process uses to access an operating system object. Processes do not work directly with raw resources like files, registry keys, threads, or network connections. Instead, when a process needs access to something, it asks Windows to open that object, and Windows returns a handle. That handle acts like a ticket which the process can use to interact with the object safely.
First, we see a user (hacker) directory. That should be noted for further analysis, because user directories contain useful evidence in NTUSER.DATand USRCLASS.DAT. These objects can be accessed after a full disk capture and will include thorough information about shares, directories, and objects the user accessed.
Inspecting the handles, we found an .eky file that was used to encrypt the system
This .eky file contains the secret the attacker needed to lock files on the system. These keys are brought from the outside and are not native system objects. Obtaining this key does not guarantee successful decryption. It depends on what kind of key file it is and how it was protected.
When you find cryptographic artifacts in handles, copy the file bytes, if possible, and get the hashes (SHA-256) before touching them. Export them into an isolated analysis workstation. Then compare the artifact to public resources and sandbox reports. Not every key-like file is the private key you need to decrypt. Sometimes attackers include only a portion or an encrypted container that requires an additional password or remote secret. Public repositories and collective projects (for example, NoMoreRansom and vendor decryptors) may already have decryption tools for some ransomware families, so check there before calling data irrecoverable.
Command Line
Now let’s inspect the command lines of the processes. Listing all command lines gives you more visibility to spot malicious behavior:
bash$ > vol -f infected.vmem windows.cmdline
You can also narrow it down to the needed PIDs or file names:
We can now see where the attack originated. After a successful compromise of a system or a domain, the attacker brought their malware to the system and encrypted it with their own keys.
The command line often contains the exact flags or network locations the attacker used (for example, -server 192.168.x.x or a path to an unpacker). Attackers sometimes use command-line switches to hide behavior, choose a configuration file, or provide a URL to download further payloads. If you can capture the command line, you often capture the attacker’s intent in plain text, which is invaluable evidence. Also check process environment variables, if those are available, because they might contain temporary filenames, credentials, or proxy settings the malware used.
Getting Hashes
Obviously the investigation does not stop here. You need to extract the file from memory, calculate its hash, and inspect how the malware behaves on AnyRun, VirusTotal, and other platforms. To extract the malware we first need to find its address in memory:
The ImageSection dump (.img) usually looks like the program that was running in memory. It can include changes made while the program was loaded, such as unpacked code or adjusted memory addresses. The DataSection dump (.dat), on the other hand, shows what the file looks like on disk, or at least part of it. That’s why there are two dumps with the same name. Volatility detected both the in-memory version and the on-disk version of or4qtckT.exe
Next we generate the hash of the DataSectionObject and look it up on VirusTotal:
We recommend using robust hashing (SHA-256 instead of MD5) to avoid collision issues.
For more information, go to Hybrid Analysis to get a detailed report on the malware’s capabilities.
Some platforms like VirusTotal, AnyRun, Hybrid Analysis, Joe Sandbox will produce behavioral reports, network traffic captures, and dropped files that help you map capabilities like network C2, persistence techniques, and whether the sample attempts to self-propagate. In our case, this sample has been found in online sandbox reports and is flagged with ransomware/WannaCry-like behavior. Sandbox summaries showed malicious activity consistent with file encryption and automated spread. When reading sandbox output, focus on three things: dropped files, outbound connections, and any use of legacy Windows features (SMB, WMI, PsExec) to move laterally.
Practical next steps for the investigator
First, preserve the memory image and any extracted files exactly as you found them. Do not run suspicious samples on your analysis workstation unless it is fully isolated. Second, gather network indicators (IP addresses, domain names) and add them to your blocklists and detection rules. Third, check for related persistence mechanisms on disk and in registry hives, if you have the disk image. Scheduled tasks, HKLM\Software\Microsoft\Windows\CurrentVersion\Run entries, service modifications, and driver loads are common. Fourth, feed the sample hash and any dropped files into public repositories and vendor sandboxes. These can help you find other victims and understand the campaign’s breadth. Finally, document everything, every command and every timestamp, so you can later show how the evidence was acquired, processed, and analyzed. For memory-specific checks, run Volatility plugins such as malfind(detect injection), ldrmodules(module loads), dlllist, netscan(network sockets), and registry plugins to inspect in-memory registry hives.
Summary
Think of memory as the attacker’s black box. It often holds the fleeting traces disk images miss, things like unpacked code, live network sockets, and cryptographic keys. Prioritizing memory first allows you to catch those traces before they’re gone. Volatility can help you list running processes, trace parent–child chains, inspect handles and command lines. You can also dump in-memory binaries and use them as artifacts for a more thorough analysis. Submitting these artifacts to sandboxes will give you a clear picture of what happened on your network, which will give you valuable IOCs to prevent this attack and techniques used. As a forensic analyst you are required to preserve the image intact, work with suspicious files in an isolated lab, and write down every command and timestamp to keep the chain of custody reliable and actions repeatable.
If you need forensic assistance, we offer professional services to help investigate and mitigate incidents. Additionally, we provide classes on digital forensics for those looking to expand their skills and understanding in this field.
For more Memory Forensics, check out our upcoming Memory Forensics class.
Login
