Acuity Health: Part 6 — Digital Forensics & EHR VIP Breach
A step-by-step digital forensics walkthrough investigating an insider exfiltration event targeting VIP patient records in an urgent care EHR database.
Incident Response
Working Backwards from Error Logs: Reverse Engineering the Tableau-to-Fabric OAuth Breakdown
🛑 The Crime Scene: A Misleading Desktop Failure When modern lakehouse architectures meet desktop analytics clients, authentication breakdowns rarely announce their true root cause. Instead, engineers are handed generic hex codes and deceptive UI prompts. During an enterprise deployment of Microsoft Fabric Warehouse, data analysts attempted to connect Tableau Desktop (2024.2.0) to the Fabric SQL/TDS endpoint (*.datawarehouse.fabric.microsoft.com) using the native Azure SQL Database connector and Microsoft Entra ID modern authentication. ...
Instituting Cyber Threat Intelligence: Predictive Blue-Team Operations
Operational blueprint for establishing a CTI program in a cloud-hosted healthcare provider, featuring threat platform evaluations and dynamic flare response.
Healthcare Incident Response, Computer Network Forensics & Containment
Digital forensics investigation and chain-of-custody framework analyzing an unauthorized EHR database breach involving VIP patient healthcare records.
Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report
This investigation provides a forensic analysis of a mobile device associated with ‘THISISDIFIR’ to determine the user’s location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical …
Standard Operating Procedures (SOP) for Digital Forensics and Evidence Handling
In the current legal and technological landscape, the integrity of an investigation depends entirely on the reliability of the evidence presented. Digital evidence is uniquely characterized by its fragility and susceptib…
Legal Admissibility of Digital Evidence: Federal Rules of Evidence and Daubert Standards
Digital evidence is defined as any data of investigative value that is stored or transmitted in binary form. Recognizing its importance helps forensic analysts feel assured in the reliability of their work when reconstru…
Mobile Device Forensics: Extraction, Decoding, and SQLite Database Analysis
What is the phone number of this phone? The phone number is the same as the Mobile Subscriber Integrated Services Digital Network (MSISDN) number for the SIM card….
Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving
Academic research analysis exploring examine the evidence using autopsy within the context of Cyber Incident Response and Computer Network Forensics….
Digital Forensics: Evidence Acquisition, Chain of Custody, and Volatile Memory Preservation
Why or why not? No, because the data changed, and since hashing algorithms are designed to produce the same value for identical inputs. Any changes to the inputs result in a different hash….