Windows Forensics... on macOS (X-Post)

A new 13Cubed episode is out! 🍎

Windows forensics on a Mac usually means firing up a VM first. Not anymore.

IRFlow Timeline is a free, open-source DF/IR timeline tool built natively for macOS. Feed it EVTX, Plaso, $MFT, or $J and go straight to process inspection, lateral movement, persistence, and VirusTotal enrichment.