Elektrine lite

← Feed

Maxim Suhanov

errno_fail@infosec.exchange

<p>Computer forensics, computer forensics tool validation, etc.</p><p><a href="https://dfir.ru" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">dfir.ru</span><span class="invisible"></span></a><br /><a href="https://github.com/msuhanov/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">github.com/msuhanov/</span><span class="invisible"></span></a></p><p>🕊</p>

Posts

  • Post #3477414

    In 2022, Microsoft decided to propagate Mark-of-the-Web into mounted containers. Here is how they did that and why third-party code (like WinRar) still fails to correctly propagate the Zone.Identifier ADS. https://dfir.ru/2026/06/29/mark-of-the-web-the-rules-changed-the-tools-didnt/