DigitalForenSeek home

Mihir Singh Choudhary

Digital Forensics and Incident Response analyst

Summary

I investigate security incidents across Windows, Linux and mobile devices, and build open-source tools that make the evidence easier to read.

TODO (author): Two or three sentences on years of experience, current focus and the kind of role sought.

Experience

TODO (author): Role title, employer (optional), dates and three to five responsibilities or outcomes per role.

Areas of practice

Platforms
Windows, Linux, iOS, Android
Investigations
Malware, Phishing, Insider threat, Fraud, Data loss prevention
Disk forensics
E01, AFF4 and RAW acquisition; Windows and Linux forensics
Memory forensics
Volatility 3, Volatility 2, MemProcFS
Mobile forensics
Cellebrite UFED, manual SQLite carving, deleted-record recovery
Cloud forensics
EC2 snapshot acquisition, EBS imaging, CloudTrail and VPC Flow Logs
Malware analysis
Ghidra, IDA Pro, static and dynamic triage, reverse engineering
Automation
Parser development and scripting

Certifications and memberships

  • GCFA: GIAC Certified Forensic Analyst GIAC
  • SC-200: Microsoft Certified: Security Operations Analyst Associate Microsoft
  • eJPT: eLearnSecurity Junior Penetration Tester INE Security
  • ICCA: INE Certified Cloud Associate INE Security
  • GIAC Advisory Board member GIAC
TODO (author): Year obtained for each certification, and credential IDs or verification links if wanted.

Education

  • B.Tech in Computer Science and Engineering Specialization in Cybersecurity, VIT
TODO (author): Campus and graduation year.

Open source

Tools

  • EventHawk v1.3.0 Windows Event Log (EVTX) analysis for DFIR: parallel parsing, DFIR profiles, ATT&CK mapping, IOC extraction and timelines.
  • Prefetch Parser in development Cross-platform Windows Prefetch (.pf) parser with a command line and a GUI.
  • PhonePe Android Forensics in development Offline, read-only analyser that rebuilds PhonePe Android app data into a unified timeline.
  • Paytm Forensics in development Offline, read-only forensic parser for data acquired from the Paytm Android app.
  • WhatsApp Web Extractor in development Forensic export of WhatsApp Web data from a browser profile on disk.

Contributions

Writing

Articles at blog.digitalforenseek.com.