Windows Event Log (EVTX) analysis for DFIR: parallel parsing, DFIR profiles, ATT&CK mapping, IOC extraction and timelines.
About
Mihir Singh Choudhary
Digital Forensics and Incident Response analyst
I investigate security incidents across Windows, Linux and mobile devices, and build open-source tools that make the evidence easier to read.
Prefer a document? View the CV.
whoami
Mihir Singh Choudhary
role DFIR analyst
focus Windows · Linux · iOS · Android
certs GCFA · SC-200 · eJPT · ICCA
tools 5 open source, 1 documentedWhat I do
Digital forensics and incident response across desktop, server and mobile platforms.
- Windows
- Linux
- iOS
- Android
-
Malware
Triage of infected systems and analysis of the malicious code involved.
-
Phishing
Tracing a malicious message from delivery to what happened after the click.
-
Insider threat
Reconstructing what an account holder did with the access they had.
-
Fraud
Recovering and correlating the records behind suspicious transactions.
-
Data loss prevention
Establishing what data left, how, and through which channel.
Selected tools
All tools on tools.digitalforenseek.com-
-
Cross-platform Windows Prefetch (.pf) parser with a command line and a GUI.
-
Offline, read-only analyser that rebuilds PhonePe Android app data into a unified timeline.
-
Offline, read-only forensic parser for data acquired from the Paytm Android app.
-
Forensic export of WhatsApp Web data from a browser profile on disk.
Try EventHawk on a Windows event log from a source install:
py -3 evtx_tool.py parse C:\Logs\Security.evtx --output results.jsonCredentials
-
GCFA
GIAC Certified Forensic Analyst
GIAC
-
SC-200
Microsoft Certified: Security Operations Analyst Associate
Microsoft
-
eJPT
eLearnSecurity Junior Penetration Tester
INE Security
-
ICCA
INE Certified Cloud Associate
INE Security
-
Advisory Board
GIAC Advisory Board member
GIAC
-
B.Tech
B.Tech in Computer Science and Engineering, specialization in cybersecurity
VIT
Open-source contributions
-
PECmd · Eric Zimmerman’s EZ Tools
Add --ads switch to scan alternate data streams for hidden prefetch
An opt-in --ads flag that scans NTFS alternate data streams for prefetch data hidden inside them, for single files, directories and Volume Shadow Copies.
Merged
-
Volatility 3 · The Volatility Foundation
Add windows.malware.apihooks plugin for Windows API hook detection
A plugin that detects Windows API hooks in memory images.
Open pull request
Contact
Email is the best way to reach me.