Guided labs
Three worked cases. Each loads a real parsed evidence set into a database inside your own browser, and you answer the questions by querying it. Nothing to install, no virtual machine, and nothing you type leaves the tab.
Every case opens in point-and-click mode: a set of named questions, each of which runs a query and then shows you the query it ran. By the third case most people are editing them, which is the entire idea.
A finance workstation, a July morning, and a binary claiming to be seven years old.
Somebody in finance reported their machine running hot. The first responder pulled a triage collection, ran it through the usual parsers, and handed you the output. There is a binary in a temp directory that says it was created in 2019, an archive nobody can find, and a logon nobody has explained.
Everything an operator did between getting in and encrypting, and the moment it became unstoppable.
A manufacturer lost a file server on a Friday morning. Encryption began at 04:31. The question the board is asking is whether anything could have caught it first, and the answer is in the four hours before, which are all here: discovery, credential theft, defence evasion, and the shadow copy deletion that is the last warning anybody ever gets.
The question every incident call opens with: which machine was first, and how do you know?
Three hosts have alerted within an hour of each other and the same account name appears on all of them. Somebody on the call has already said it was the domain controller, because that is where the noisy alert fired. The logon records from all three are here. Sort them and the story goes the other way.
