Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to retention.

Collection

Format

AnalysisConstructed

Evidence Gap Challenge No. 2: the proxy only kept the domain

A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.

12 Sept 2026about 40 minutes of workT1195.001T1059.007T1552.001evidence-gap-challenge evidence retention supply-chain

AnalysisConstructed

Evidence Gap Challenge No. 1: the laptop was reimaged on Tuesday

A supplier is out €96,000 and the only endpoint that mattered was wiped on day one, by a helpdesk following the documented process correctly. Here is every artefact that still exists. Work out what you can prove, what you can only say is consistent, and the one collection change that would have moved the most from the second column to the first.

9 Sept 2026about 45 minutes of workT1566.002T1114.002T1078.004evidence-gap-challenge bec evidence retention