←Skills
PROFILE DOSSIER • DFIR & RE RESEARCHER

Abdo

Digital Forensics & Incident Response (DFIR) practitioner and Reverse Engineer. I focus on low-level artifact carving, memory analysis, covert network traffic dissection, and writing automated Python solvers for forensic investigations.

PRACTITIONER OVERVIEW

Investigation Methodology

FOCUS: DUAL-PATH FORENSICS

Too many incident writeups rely entirely on automated black-box tools without understanding the underlying byte structures or OS mechanisms. When I investigate a breach or solve a security challenge, I apply a strict dual-path methodology:

[1] Manual Root-Cause Analysis

Inspecting raw hexadecimal structures, parsing partition tables, following dead-key state machines, and auditing decompiled functions in Ghidra to understand the precise mechanics.

[2] Reproducible Code Automation

Translating findings into clean, standalone Python scripts and rapid CLI one-liners so evidence extraction is verifiable, repeatable, and scalable.

Explore CTF Writeups (40+)Curriculum VitaeGitHub Projects ↗
AUTOMATED PROFILE AUDIT // AI EVALUATION BENCHMARK

Technical Competency Rating

Automated heuristic evaluation synthesized from 40+ forensic walkthroughs, binary dissections, and solver repositories.

OVERALL RATING
TIER 1 // A+
96/ 100
Artifact & Disk ForensicsMastery // Tier 1
98 / 100
Analysis Verdict:Exemplary precision parsing NTFS, ESE databases, and Apple CoreStorage volume groups.
Observed Evidence:Recovered FileVault keys via raw inode carving; unpacked complex ESE database blobs.
Tool Automation & Solver EngineeringMastery // Tier 1
97 / 100
Analysis Verdict:Consistently authors standalone Python scripts and one-liners that automate complex manual workflows.
Observed Evidence:40+ custom Python solvers built across scapy, pycryptodome, and raw byte manipulation.
Memory Forensics & Injection TriageAdvanced // Tier 1
96 / 100
Analysis Verdict:In-depth kernel and user-space memory triage via Volatility 3 and custom heap carvers.
Observed Evidence:Identified PoolParty Variant 7 injection, unmapped VAD regions, and process stomping.
Network Forensics & Covert ChannelsAdvanced // Tier 1
95 / 100
Analysis Verdict:Specialized in detecting and reconstructing non-standard exfiltration channels.
Observed Evidence:Decoded TLS 1.3 GREASE covert payloads and TCP urgent pointer bit streams.
Binary Reverse EngineeringAdvanced // Tier 1
94 / 100
Analysis Verdict:Rigorous static and dynamic analysis across Windows PE, Linux ELF, and macOS Mach-O.
Observed Evidence:Hijacked instruction pointers in debuggers to execute hidden decode routines.
Technical Arsenal

Core Skills & Practical Tooling

Digital Forensics & Incident Response

  • ▸Memory Analysis (Volatility 3, VAD Tree Parsing, PoolParty Injection)
  • ▸Disk & Artifact Triage (KAPE, Autopsy, FTK Imager)
  • ▸Windows Artifact Carving ($MFT, ESE Databases, PCA, Prefetch, SRUM)
  • ▸Apple macOS Forensics (CoreStorage Fusion Drive, FileVault Recovery)

Reverse Engineering & Binary Analysis

  • ▸Static Disassembly & Decompilation (Ghidra, IDA Pro)
  • ▸Dynamic Debugging & Register Control (x64dbg, GDB, WinDbg)
  • ▸Backdoored Mach-O & ELF Binary Deobfuscation
  • ▸Binary Patching & Unreferenced Routine Execution

Network & Protocol Forensics

  • ▸Packet Stream Reassembly (Wireshark, tshark)
  • ▸TLS Covert Channel Analysis (GREASE 0x0a0a Extension Extraction)
  • ▸TCP Urgent Pointer Covert Exfiltration Decoding
  • ▸VoIP & RTP Audio Stream Carving (SIP Handshake, G.711 PCMU)

Scripting, Cryptanalysis & Automation

  • ▸Python 3 Automation (scapy, pycryptodome, PIL, pyshark, struct)
  • ▸PowerShell 5.1 / 7 & Bash Forensics One-Liners
  • ▸Cryptographic Decryption (AES-CBC, ChaCha20, RC4, Custom XOR)
  • ▸YARA Rule Development & Signature Engineering

Let's Connect

Available for security consulting, forensic analysis, incident response triage, and specialized tool development.

GitHub ↗View CV ↗