My DFIR Blog

Vulnerabilities in Full-Disk Encryption Systems (PDF) Plaintext disclosure (re)discovered in BestCrypt Volume Encryption (NotCVE-2026-0004, not fixed).

There are many CVE IDs assigned for various issues resulting in missing or improper Mark-of-the-Web (MOTW) propagation when extracting files from archives (#1, #2, #3, #4, #5, #6, and so on).

TL;DR: The Windows Event Logging Service contains a bug (use of uninitialized memory) that sometimes results in recently deleted (cleared) log entries being stored in other (unrelated) *.evtx journal files.

Recently, IEEE released the P1619/D12 (October 2024) draft that changes the XTS mode of operation of the AES cipher.

Background Let’s take a look at the following piece of code: if (is_infected_file(path)) { remove_file(path); } This is a oversimplified routine from a typical antivirus scanner — it takes a file path, checks data of that file using malware signatures,…

Please, refer to this Wikipedia article if you need some theory… My paper is here.

Background The same malformed file system structures can cause problems in independently developed file system parsers… For example, missing boundary checks when parsing the NTFS update sequence array resulted in two vulnerabilities disclosed before: one…

As I demonstrated before, the same malformed file system structures can cause overflows/over-reads in independently developed software.

Have you ever seen files like “Op-EXPLORER.EXE-03C49D11-000000F5.pf“?

One can set a password to protect the boot menu entries and the command-line shell of the GRUB boot manager (see the official manual and the Red Hat manual).