A
Andrea Fortuna
andreafortuna.org · Personal blog · on HN since 2013
Andrea Fortuna, a cybersecurity professional, writes about digital forensics, Linux tips, vulnerabilities, and security policy.
What HN saysHN commenters link it as a source for forensics topics such as amcache and shimcache, iPhone metadata, and /dev/tcp tricks.
18HN people shared it
6linked it in comments
22stories submitted
674story points
3 months agolast shared
2013people per year2026
Most-shared posts
- 1Some useful tips about /dev/tcp3 people · 5 points · first shared 2021 · discussion on HN
- 2Chat Control proposal fails again after public opposition1 people · 595 points · first shared 2025 · 157 comments on HN
- 3Kubernetes is a symptom, not a solution1 people · 37 points · first shared 2025 · 30 comments on HN
- 4Every log must fire: applying Chekhov's gun to cybersecurity incident reports1 people · 5 points · first shared 2025 · 3 comments on HN
- 5Simjacker: A new vulnerability exploited for espionage operation1 people · 4 points · first shared 2019 · discussion on HN
- 6Every GPS satellite is a numbers station1 people · 3 points · first shared 2026 · discussion on HN
- 7Old code never dies: why legacy software is often safer than new code1 people · 3 points · first shared 2026 · discussion on HN
- 8A sentimental tour of late 1990s and early 2000s hacking tools1 people · 3 points · first shared 2026 · discussion on HN
- 9Android pattern of life:hidden artifacts that reconstruct a user's daily routine1 people · 2 points · first shared 2026 · discussion on HN
- 10Forensic tools as instruments of repression: Cellebrite use in Russia1 people · 2 points · first shared 2026 · discussion on HN
- 11IMP4GT: IMPersonation Attacks in 4G NeTworks1 people · 2 points · first shared 2020 · discussion on HN
- 12When the city becomes the weapon: IoT, AI, and the new face of warfare1 people · 2 points · first shared 2026 · discussion on HN
- 13YATTRSSC: compile the project on iOS and Android1 people · 2 points · first shared 2013 · discussion on HN
- 14WhatsApp forensics in 2026 and what survives end-to-end encryption1 people · 2 points · first shared 2026 · discussion on HN
- 15Pass-ta-key attacks steal passkeys instead of passwords1 people · 1 points · first shared 2026 · 1 comments on HN
What HN people wrote when they linked it
neya · 2026-03-04
First page, first result on Google:
https://andreafortuna.org/2025/11/30/hidden-metadata-reveals-what-your…
c00lio · 2023-06-21
Why would (pseudocode, nonexisting but possible example) write(SIGKILL, "/proc/12345/signals") not be possible? For the other direction, there is signalfd in Linux. And of course you can get a peer address from /dev/tcp (https://andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ ). Yes, /dev/tcp is not an OS primitive but a bash builtin, but there isn't really a reason you cannot do this in the OS. Shared memory can be a file, you just have to mmap() it. mmap is always left out of the open/close/read/write-enumeration of the traditional file API, but I think it is actually extremely useful and should be the fifth alongside those.
Debugging is hard to imagine, yes. One could look at /proc/12345/mem, write breakpoints in there, but I'm not sure about how to do the more exotic things.
badrabbit · 2022-04-15
Checkout amcache and shimcache, recent files, bam/dam. https://andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic…
coding123 · 2021-06-13
Pretty soon you could get through it with an unmodified iPad...
https://www.andreafortuna.org/2021/03/13/coding-on-ipad-pro-my-own-set…
Not sure when it's going to be out of beta.
leafmeal · 2020-10-20
I was wondering this too.
This isn't a direct answer to your question, but a quick search turned up this article for finding unsecured assets in a Google bucket https://www.andreafortuna.org/2019/08/07/some-useful-tools-for-finding…
sdmike1 · 2020-01-16
There is a tool used in malware analysis and computer forensics called Volatility[0]. It has some very powerful analysis tools and works on Linux Mac and Windows. In your case its ability to dump the memory of a running process without messing with the process state [1] may be very helpful! It also has the ability to run a Yara scan against the dumped memory which could let you find the region of memory containing the config file (so long as you know some of the strings in it).
Hope this helps!
[0] https://github.com/volatilityfoundation/volatility
[1] https://www.andreafortuna.org/2017/07/10/volatility-my-own-cheatsheet-…