CyberCode Academy episodes:

• June 15, 2026Course 37 - Building Web Apps with Ruby On Rails | Episode 2: Navigating the Framework of Frameworks

  In this lesson, you’ll learn about: Ruby on Rails internals and how its integrated components process a web request from start to response1. Rails as a “Framework of Frameworks”Ruby on Rails is built as a collection of tightly integrated components:
  

  • Routing system
  • Controllers
  • ORM (database layer)
  • View rendering engine
  • Asset management

  🔹 Key Idea
  Rails combines multiple subsystems into one unified development ecosystem2. Request Lifecycle (High-Level Flow)User request → Router → Controller → Model → View → Response👉 Key Insight
  Every web request travels through a structured pipeline inside Rails3. Action Pack & Routing (Entry Point)🔹 What it does
  Handles incoming HTTP requests🔹 Key components:
  

  • Router → maps URL to controller action
  • Controllers → process request logic

  🔹 RESTful routing:
  

  • Standard URL patterns for resources
  • Example:
    • /posts → index
    • /posts/1 → show

  👉 Key Insight
  Routing connects the outside world to internal application logic4. Controllers (Application Logic Layer)🔹 Responsibilities:
  

  • Receive requests
  • Interact with models
  • Prepare data for views

  🔹 Data passing:
  

  • Uses instance variables (e.g., @user)

  👉 Key Insight
  Controllers act as the decision-making layer in MVC5. Active Record (ORM & Data Layer)🔹 What it is
  Rails’ built-in ORM system🔹 Core functions:
  

  • Maps Ruby objects to database tables
  • Handles CRUD operations automatically

  🔹 Key FeaturesDatabase Migrations
  

  • Version-controlled schema changes

  Validations
  

  • Ensure data integrity before saving

  Callbacks
  

  • Trigger logic during lifecycle events (create, update, delete)

  👉 Key Insight
  Active Record eliminates the need to write raw SQL in most cases6. Models (Business Logic + Data Rules)🔹 What models do:
  

  • Represent database entities
  • Enforce rules and relationships

  👉 Key Insight
  Models combine data + logic into a single layer7. Action View (Response Rendering)🔹 What it does
  Generates the final output (usually HTML)🔹 Uses:
  

  • Embedded Ruby (ERB) templates
  • Dynamic content rendering

  🔹 Key ComponentsLayouts
  

  • Shared page structure

  Partials
  

  • Reusable view components

  👉 Key Insight
  Views transform raw data into user-facing interfaces8. Asset Pipeline (Frontend Assets)🔹 Manages:
  

  • CSS
  • JavaScript
  • Images

  🔹 Features:
  

  • Compression
  • Minification
  • Organization

  👉 Key Insight
  Rails optimizes frontend assets automatically9. Modern Frontend Integration**🔹 Tools used:
  

  • Webpacker
  • Turbolinks

  🔹 What they doWebpacker
  

  • Bundles JavaScript modules and dependencies

  Turbolinks
  

  • Speeds up navigation by avoiding full page reloads

  👉 Key Insight
  Rails blends backend power with modern frontend performance10. Full Request Flow (Step-by-Step)
  

  1. User sends request (URL)
  2. Router maps it to a controller
  3. Controller processes logic
  4. Model interacts with database
  5. Data returned to controller
  6. View renders response
  7. Final HTML/JSON sent to user

  Key Takeaways
  

  • Rails is built as multiple integrated frameworks
  • Routing directs requests to controllers
  • Active Record handles database interaction
  • Views generate dynamic user interfaces
  • Frontend tools enhance performance and usability

  Big PictureRails works as a complete system to:👉 Transform user requests into structured responses
  👉 Automate repetitive development tasks
  👉 Maintain clean separation of concerns using MVCMental ModelHTTP request → routing → controller logic → database interaction → view rendering → response output
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 14, 2026Course 37 - Building Web Apps with Ruby On Rails | Episode 1: From Ruby Basics to Web Development Conventions

  In this lesson, you’ll learn about: Ruby on Rails, its architecture, philosophy, and how it simplifies modern web development 1. What Is Ruby on Rails? Ruby on Rails is a full-stack web framework used to build:
  

  • Web applications
  • APIs
  • Database-driven platforms

  🔹 Key Idea
  Rails is a complete development toolkit that handles everything from backend logic to routing and database interaction. 2. Ruby vs Rails (Core Difference) 🔹 Ruby
  

  • A dynamic, object-oriented programming language

  🔹 Rails
  

  • A framework built on top of Ruby

  👉 Key Insight
  Ruby provides the power, Rails provides the structure and automation 3. MVC Architecture (Core Design Pattern) 🔹 MVC stands for:
  

  • Model → Handles data and database logic
  • View → Handles UI and presentation
  • Controller → Handles request/response logic

  👉 Key Insight
  MVC separates responsibilities, making applications easier to manage and scale. 4. Rails as a Full-Stack Framework Rails can:
  

  • Render HTML pages (server-side)
  • Serve JSON APIs
  • Handle routing, sessions, and authentication

  👉 Key Insight
  Rails acts like a multi-tool for building complete applications 5. The Power of Ruby (Why Rails Feels “Magic”) 🔹 Ruby features:
  

  • Highly expressive syntax
  • Object-oriented design
  • Flexible and dynamic behavior

  🔹 Example:
  

  • .2.days.ago → human-readable time calculation

  👉 Key Insight
  Ruby allows Rails to write less code while doing more work 6. Convention Over Configuration 🔹 What it means:
  

  • Rails follows predefined conventions instead of requiring manual setup

  🔹 Example:
  

  • Person model → automatically maps to people table

  👉 Key Insight
  Developers don’t waste time making small decisions—Rails handles them 7. The Rails Doctrine Created by David Heinemeier Hansson 🔹 Core principles:
  

  • Optimize for developer happiness
  • Embrace convention over configuration
  • Favor integrated systems

  👉 Key Insight
  Rails is opinionated to make development faster and more enjoyable 8. Routing and RESTful Design 🔹 Rails automatically generates:
  

  • Predictable URLs
  • REST-based routes

  🔹 Example:
  

  • /users → list users
  • /users/1 → show user

  👉 Key Insight
  Routing becomes standardized and easy to understand 9. Monolith vs Microservices 🔹 Rails philosophy:
  

  • Prefer monolithic architecture (everything in one app)

  🔹 Real-world usage:
  

  • Companies like GitHub and Shopify scaled successfully using Rails

  👉 Key Insight
  A well-structured monolith can scale efficiently without microservices complexity Key Takeaways
  

  • Rails is a full-stack framework built on Ruby
  • MVC architecture organizes application structure
  • Ruby enables expressive and powerful code
  • Convention over configuration speeds up development
  • Rails favors integrated systems over complexity

  Big Picture Rails helps developers: 👉 Build applications faster with less code
  👉 Focus on logic instead of configuration
  👉 Scale applications using structured conventions Mental Model Ruby language → Rails framework → MVC structure → conventions applied → rapid web development
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 13, 2026Course 36 - Windows Forensics and Tools | Episode 15: Uncovering Digital Evidence from Headers and Servers

  In this lesson, you’ll learn about: email forensics and how investigators trace the origin and authenticity of emails using technical artifacts and server data1. What Is Email Forensics?Email forensics is the process of analyzing emails to:

  • Identify the real sender
  • Detect tampering or spoofing
  • Reconstruct the path an email traveled
  • Gather evidence for cyber investigations

  🔹 Key Idea
  Every email leaves behind a traceable digital trail, even if the content is altered or deleted.2. Email Lifecycle (How Emails Travel)An email typically moves through several systems:

  • MUA (Mail User Agent): The email client (e.g., Outlook, webmail)
  • MTA (Mail Transfer Agent): Servers that route emails across the internet
  • Multiple intermediate mail servers before reaching the recipient

  👉 Key Insight
  Each hop adds metadata that becomes part of the email’s permanent record.3. Email Headers (The “Gold Mine”)🔹 What email headers contain:

  • Sender and recipient information
  • Server IP addresses
  • Time stamps for each relay
  • Authentication results

  👉 Key Insight
  Headers cannot easily be faked completely, making them crucial for investigations.4. Header Analysis (Bottom-to-Top Method)Investigators analyze headers starting from the bottom:🔹 Why bottom-to-top?

  • The bottom shows the original source
  • Each line above shows the email’s path through servers

  🔹 What you can find:

  • Original sender IP
  • First mail server used
  • Path of email delivery

  👉 Key Insight
  This method helps uncover the true origin of suspicious emails.5. Detecting Email AttacksEmail forensics helps identify:🔹 Spoofing

  • Fake sender addresses

  🔹 Phishing

  • Deceptive emails designed to steal credentials

  🔹 Internal leaks

  • Unauthorized data sent outside an organization

  👉 Key Insight
  Even carefully crafted malicious emails often leave traceable technical evidence.6. Supporting Evidence SourcesInvestigators also use:

  • Mail server logs
  • Network device logs (firewalls, proxies)
  • Authentication records

  👉 Key Insight
  Cross-checking multiple logs increases investigation accuracy.7. Forensic Tools Used in Email Analysis🔹 Common tools include:

  • Email tracking and analysis utilities
  • Digital forensic suites (e.g., FTK-based tools)

  🔹 What they help with:

  • Header decoding
  • Attachment analysis
  • Password recovery (in some cases)
  • Evidence extraction and reporting

  👉 Key Insight
  Tools automate complex parsing but rely on human interpretation.Key Takeaways

  • Email headers contain the most critical forensic evidence
  • Emails pass through multiple servers, each leaving traces
  • Bottom-to-top header analysis reveals the original sender
  • Server logs help validate email authenticity
  • Tools assist, but analysis logic is what finds the truth

  Big PictureEmail forensics helps investigators:👉 Identify real attackers behind fake identities
  👉 Trace communication paths across servers
  👉 Prove or disprove email authenticity in cyber incidentsMental ModelEmail sent → passes through servers → headers accumulate → forensic analysis reconstructs origin and path
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 12, 2026Course 36 - Windows Forensics and Tools | Episode 14: A Guide to Steganography and OpenStego

  In this lesson, you’ll learn about: steganography and how hidden data is embedded inside digital files without raising suspicion1. What Is Steganography?Steganography is the practice of hiding information inside other non-suspicious data such as images, audio, or video files.🔹 Key Idea
  Unlike encryption, which hides the content of a message, steganography hides the existence of the message itself.2. Steganography vs Encryption🔹 Encryption

  • Scrambles data into unreadable form
  • Clearly shows that secret communication exists

  🔹 Steganography

  • Hides data inside another file
  • Makes the communication look completely normal

  👉 Key Insight
  Steganography is about stealth, not just security.3. How Digital Steganography WorksHidden data is embedded inside a cover file, such as:

  • Images (PNG, JPG)
  • Audio files
  • Video files

  🔹 Common technique

  • Modifying least significant bits (LSB) of pixels
  • Using unused or redundant data space

  👉 Key Insight
  Small changes are visually or audibly unnoticeable but can store hidden data.4. Types of Steganography Uses🔹 Legitimate uses:

  • Digital watermarking (copyright protection)
  • Metadata tagging
  • Secure communication channels

  🔹 Malicious uses:

  • Hiding malware payloads
  • Command-and-control communication
  • Evading security detection

  5. Steganography Workflow (Conceptual)Cover file → Hidden data embedded → Stego file created → Extraction with key/password👉 Key Insight
  Only someone with the correct method or password can extract the hidden content.6. OpenStego Tool (Practical Implementation)🔹 What it is
  An open-source tool used to embed and extract hidden data in images🔹 Main capabilities:

  • Hide text or files inside images
  • Apply password-based protection
  • Extract embedded content later

  7. Hiding Data Process🔹 Steps involved:

  • Select cover image (e.g., PNG file)
  • Choose secret file (text or document)
  • Apply password encryption (optional)
  • Generate stego image

  👉 Key Insight
  The output file looks identical to the original image.8. Extracting Hidden Data🔹 Requirements:

  • Original stego image
  • Correct password (if used)

  🔹 Process:

  • Run extraction tool
  • Recover hidden file or message

  👉 Key Insight
  Without the key/password, extraction becomes extremely difficult.9. Forensic Detection of Steganography🔹 Indicators investigators look for:

  • Unexpected file size increase
  • Image metadata inconsistencies
  • Pixel-level anomalies
  • Suspicious compression patterns

  👉 Key Insight
  Steganography often leaves subtle but detectable digital traces.Key Takeaways

  • Steganography hides the existence of data, not just its content
  • It works by embedding information inside cover files
  • Images are the most commonly used carrier
  • Tools like OpenStego allow both embedding and extraction
  • Detection requires careful forensic analysis

  Big PictureSteganography is used to:👉 Create invisible communication channels
  👉 Evade detection systems
  👉 Protect or hide sensitive informationMental ModelSecret data → embedded into normal file → stego file appears harmless → hidden extraction reveals message
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 11, 2026Course 36 - Windows Forensics and Tools | Episode 13: Decoding Registry Artifacts and Connection History

  In this lesson, you’ll learn about: Windows USB forensics and how external device activity is tracked through the Windows Registry1. What Is Windows USB Forensics?USB forensics focuses on identifying and analyzing traces left by:
  

  • USB flash drives
  • External hard drives
  • Digital cameras and mobile storage devices

  🔹 Key Idea
  Even after a device is unplugged or removed, Windows keeps permanent evidence of its connection.2. Why USB Devices Leave Forensic EvidenceWhen a USB device is connected, Windows automatically:
  

  • Logs device identity
  • Stores serial numbers
  • Records connection history
  • Links devices to specific users

  🔹 Forensic Value
  This allows investigators to reconstruct:
  

  • Who used the device
  • When it was connected
  • What machine it was connected to

  3. USBSTOR Registry Key (Device Identity Tracking)🔹 What it is
  A registry location that stores details of USB storage devices🔹 What it records
  

  • Vendor name (e.g., SanDisk, Kingston)
  • Product model
  • Unique serial number

  👉 Key Insight
  This is the digital fingerprint of every USB device ever connected4. MountedDevices Key (Drive Letter Mapping)🔹 What it is
  Links physical USB devices to assigned drive letters (E:, F:, etc.)🔹 What it reveals
  

  • Which USB got which drive letter
  • How Windows mapped the storage at connection time

  👉 Key Insight
  Helps reconstruct how the system interacted with external storage5. MountPoints2 Key (User-Level Evidence)🔹 What it is
  Stores per-user information about mounted devices🔹 What it reveals
  

  • Which user connected the device
  • Access history from user profile perspective

  👉 Key Insight
  Connects USB activity directly to a specific Windows user account6. Forensic Significance of USB Artifacts🔹 What investigators can determine:
  

  • First time a device was plugged in
  • Last time it was used
  • Frequency of usage
  • Possible data transfer activity

  👉 Key Insight
  USB history helps build a complete behavioral timeline of data movement7. USBDeview Tool (Practical Analysis)🔹 What it does
  Automatically extracts USB history from the system🔹 What it shows
  

  • Device name and model
  • Serial number
  • First/last connection time
  • Plug/unplug events

  👉 Key Insight
  Turns raw registry data into readable forensic evidence8. Live System Analysis Considerations🔹 When analyzing active systems:
  

  • Registry must be extracted carefully
  • Evidence integrity must be preserved
  • Avoid modifying timestamps or device traces

  👉 Key Insight
  Live analysis requires strict forensic discipline to avoid contamination9. Linking USB Devices to Real-World Activity🔹 Investigation process:
  USB device → Registry traces → User account → Timeline reconstruction👉 Key Insight
  This allows investigators to connect a physical device to a specific suspect machineKey Takeaways
  

  • Windows permanently records USB device history in the registry
  • USBSTOR stores device identity and serial numbers
  • MountedDevices maps USBs to drive letters
  • MountPoints2 links devices to specific users
  • Tools like USBDeview simplify forensic extraction

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 10, 2026Course 36 - Windows Forensics and Tools | Episode 12: A Forensic Guide to Windows User Artifacts

  In this lesson, you’ll learn about: Windows user artifacts and forensic activity tracking1. What Are Windows User Artifacts?

  • System-generated traces of user behavior
  • Created automatically by Windows and applications

  🔹 Key Idea

  • Even if a user deletes files, system artifacts often remain

  2. Evolution of User Profiles🔹 Older vs Modern Windows

  • Windows XP:
    • Documents and Settings
  • Windows 7 / 10 / 11:
    • C:\Users

  🔹 Why it changed

  • Improved structure
  • Better separation of user data
  • Easier forensic navigation

  3. NTUSER.DAT (Core User Hive)🔹 What it is

  • Main registry file for user-specific settings

  🔹 What it reveals

  • Last login activity
  • User preferences
  • Recently used programs

  👉 Key Insight:

  • It is the digital identity record of a Windows user

  4. AppData Folder🔹 Location

  • Stored inside user profile directory

  🔹 What it contains

  • Application settings
  • Cached data
  • Local program databases
  • Address books and configurations

  👉 Key Insight:

  • Applications silently store deep behavioral data here

  5. Cookies and Web Tracking🔹 What cookies reveal

  • Login sessions
  • Browsing behavior
  • Website preferences

  👉 Forensic value:

  • Helps reconstruct web activity patterns

  6. Recent Files (User Activity Tracking)🔹 “Recent” folder behavior

  • Stores shortcuts (.lnk files) to opened files

  🔹 What it tracks

  • Files opened
  • Execution paths
  • Access timestamps

  👉 Key Insight:

  • Even if original file is deleted, shortcut evidence remains

  7. Desktop, Favorites, and Start Menu🔹 Desktop

  • Visible + hidden user activity area

  🔹 Favorites

  • Stored browsing shortcuts

  🔹 Start Menu

  • Application execution history

  👉 Key Insight:

  • These locations reflect user intent and behavior patterns

  8. Send To Folder🔹 Purpose

  • Provides quick file transfer options

  🔹 Forensic value

  • Shows interaction with:
    • External drives
    • Applications
    • System tools

  9. Junction Points🔹 What they are

  • Advanced Windows links between directories

  🔹 Why they matter

  • Reveal hidden system relationships
  • Help map user navigation paths

  10. Public vs User Data Structure🔹 Windows design concept

  • Combines:
    • Public shared folders
    • Private user folders

  👉 Key Insight:

  • Helps identify what was shared vs personally accessed

  11. Forensic Importance🔹 What investigators reconstruct

  • User behavior timeline
  • File access history
  • Application usage patterns
  • Device interaction history

  Key Takeaways

  • Windows generates extensive hidden user artifacts
  • NTUSER.DAT is central to user behavior tracking
  • AppData stores deep application-level evidence
  • Recent files and shortcuts reveal file access history
  • System folders reflect real user activity, not just file storage

  Big PictureUser artifacts help investigators:👉 Move from “files on disk” → “human actions behind the system”Mental Model

  • User action → system artifact → hidden record → forensic reconstruction

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 09, 2026Course 36 - Windows Forensics and Tools | Episode 11: Unlocking Hidden Metadata and Browser History

  In this lesson, you’ll learn about: forensic authentication using metadata and browser artifacts1. What is Digital Forensic Authentication?

  • A process of verifying user activity and file origin using hidden data
  • Focuses on:
    • Documents
    • Images
    • Web browsing activity

  🔹 Key Idea

  • Files contain more than visible content—they carry hidden identity traces

  2. File Metadata (Documents & Office Files)🔹 What metadata reveals

  • Author name
  • Creation machine
  • Editing history
  • Last modified timestamps

  🔹 Why it matters

  • Helps identify:
    • Who created a file
    • When it was edited
    • Whether it was tampered with

  👉 Key Insight:

  • Metadata can contradict user claims

  3. Image Metadata (EXIF Data)🔹 What is EXIF?

  • EXIF data

  🔹 What EXIF contains

  • Camera model
  • GPS location (if enabled)
  • Date and time
  • Exposure settings
  • Device information

  👉 Key Insight:

  • Images act like a digital fingerprint of the camera and environment

  4. Forensic Value of Images

  • Link images to:
    • Physical locations
    • Devices used
    • Timeline of events

  5. Browser History Persistence🔹 Common misconception

  • Users think deleting history removes all traces

  🔹 Reality

  • Browsers store persistent artifacts in system files

  6. Internet History Storage Locations🔹 Legacy Systems

  • index.dat files

  🔹 Modern Systems

  • WebCacheV01.dat

  7. What WebCacheV01.dat Stores

  • Visited URLs
  • Download history
  • Browsing timestamps
  • Cached session data

  👉 Key Insight:

  • Even private browsing leaves traces in system databases

  8. Forensic Tools🔹 Example tool

  • ESE Database View

  🔹 What it does

  • Extracts data from browser history databases
  • Reconstructs user activity timelines
  • Reveals deleted browsing records

  9. Private Browsing Myths🔹 Important fact

  • InPrivate / Incognito:
    • Hides local history in UI
    • Does NOT fully remove system-level traces

  10. Forensic Applications🔹 Investigators can recover

  • Visited websites
  • Downloaded files
  • Search behavior
  • Hidden browsing sessions

  Key Takeaways

  • Metadata reveals hidden details about files and images
  • EXIF data acts as a digital fingerprint for photos
  • Browser activity is stored in system-level databases
  • Deleting history does not guarantee deletion of evidence
  • Specialized tools can reconstruct full browsing behavior

  Big PictureThis topic helps investigators:👉 Move from visible files → hidden behavioral evidenceMental Model

  • File/Image → Metadata layer → System storage → Forensic reconstruction

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 08, 2026Course 36 - Windows Forensics and Tools | Episode 10: Decoding Metadata and File Internals

  In this lesson, you’ll learn about: Windows Recycle Bin forensics and deleted file recovery1. Why the Recycle Bin Matters in Forensics

  • Deleting a file in Windows does not immediately erase it
  • Instead, Windows:
    • Moves it to a hidden system structure
    • Renames it
    • Keeps both metadata and data intact

  🔹 Key Idea

  • The Recycle Bin is often a hidden evidence repository

  2. Core Forensic Insight

  • Deleted files usually remain:
    • On disk (physically intact)
    • With modified references only

  👉 Result:

  • Investigators can often recover:
    • Files
    • Paths
    • Deletion timestamps

  3. Legacy Windows Recycle Bin (Windows XP and earlier)🔹 Structure Used

  • INFO2 file
  • Stored inside:
    • Recycler folder

  🔹 What it contains

  • Original file path
  • File size
  • Deletion order

  👉 Key Insight:

  • Acts as an index of deleted files

  4. Modern Windows Recycle Bin (Vista → Windows 10)🔹 Structure Used

  • $Recycle.Bin

  🔹 File Pair SystemEach deleted file creates two entries:

  • $R file
    • Contains actual file data
  • $I file
    • Contains metadata:
      • Original name
      • Path
      • Deletion timestamp

  👉 Key Insight:

  • Data and metadata are split for tracking integrity

  5. Windows 10 Forensic Markers🔹 Version Identification

  • $I file headers contain version indicators:
    • 01 → older Windows versions
    • 02 → Windows 10 era

  🔹 Why it matters

  • Helps investigators determine:
    • Operating system version
    • Timeline of deletion activity

  6. Hex-Level Analysis🔹 Tools used

  • Hex editors
  • Forensic analysis tools

  🔹 What investigators extract

  • File paths
  • Deletion timestamps
  • File size metadata
  • Original filenames

  👉 Key Insight:

  • Even “deleted” files can be reconstructed byte-by-byte

  7. Forensic Workflow🔹 Step-by-step process

  1. Access $Recycle.Bin
  2. Match $R and $I files
  3. Decode metadata
  4. Reconstruct original file structure
  5. Extract evidence

  8. Investigative Value🔹 What can be recovered

  • Deleted documents
  • Malware payloads
  • Sensitive user files
  • Evidence of file wiping attempts

  👉 Key Insight:

  • Attackers often forget the Recycle Bin still holds traces

  Key Takeaways

  • Recycle Bin does not permanently delete data immediately
  • Legacy systems use INFO2 index files
  • Modern systems use $R and $I file pairs
  • Metadata and file content are separated
  • Hex analysis allows full reconstruction of deleted activity

  Big PictureRecycle Bin forensics helps investigators:👉 Move from “deleted file” → “recoverable digital evidence”Mental Model

  • Delete action → Recycle Bin redirect → hidden storage → forensic recovery

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 07, 2026Course 36 - Windows Forensics and Tools | Episode 9: Uncovering Hidden Evidence

  In this lesson, you’ll learn about: Windows System Restore Points in digital forensics1. What Are System Restore Points?

  • A Windows feature that creates snapshots of system state
  • Designed for recovery after:
    • System failures
    • Bad updates
    • Software issues

  🔹 Key Idea

  • They act as a historical snapshot of system behavior

  2. Why They Matter in Forensics

  • Restore points preserve evidence that may be:
    • Deleted
    • Wiped
    • Modified

  🔹 Forensic Value

  • Helps reconstruct:
    • System changes
    • Malware introduction
    • Configuration modifications

  3. What Is Stored in Restore Points

  • Registry snapshots
  • Selected system files
  • Configuration data
  • Logs and application traces

  👉 Important Insight:

  • They preserve system state, not just individual files

  4. Metadata Preservation🔹 Key Concept

  • Restore points preserve MAC times:
    • Modified
    • Accessed
    • Created

  🔹 Why it matters

  • Enables accurate timeline reconstruction
  • Helps detect tampering or backdating attempts

  5. Trigger Events for Restore Points🔹 When Windows creates them

  • Software installation
  • System updates
  • Every ~24 hours of uptime
  • Manual user trigger

  👉 Key Insight:

  • Restore points are often created during high system activity periods

  6. Internal Structure of Restore Points🔹 Storage Location

  • Hidden directory:

  C:\System Volume Information 🔹 Folder Structure

  • Stored as sequential folders:
    • RP1
    • RP2
    • RP3
    • etc.

  7. File Tracking Mechanism🔹 Key Component

  • filelist.xml

  🔹 Purpose

  • Defines:
    • Which file types are monitored
    • Which directories are included

  👉 Key Insight:

  • Acts as a control map for snapshot creation

  8. Change Tracking System🔹 Important File

  • change.log

  🔹 Function

  • Records:
    • Original filenames
    • File locations
    • Snapshot changes

  👉 Forensic Value:

  • Helps reconstruct original file paths even after renaming

  9. System Management and Registry Control🔹 Registry Role

  • Controls:
    • Enable/disable restore points
    • Storage allocation
    • Behavior settings

  🔹 Storage Management

  • Uses FIFO (First-In, First-Out) rule
  • Older restore points are deleted first

  10. Forensic Applications🔹 What investigators can uncover

  • Malware presence in past states
  • Deleted files
  • System configuration changes
  • Evidence of cleanup attempts

  👉 Key Insight:

  • Restore points can reveal what was intentionally removed

  Key Takeaways

  • System Restore Points are system snapshots used for recovery
  • They preserve registry and file state over time
  • Stored in hidden System Volume Information directory
  • Include logs that track file changes and metadata
  • Can reveal deleted or tampered forensic evidence

  Big PictureRestore points help investigators:👉 Move from current system state → historical system reconstructionMental Model

  • System snapshot → stored RP folder → logs + registry + files → forensic timeline

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---

• June 06, 2026Course 36 - Windows Forensics and Tools | Episode 8: Efficiency, Evidence, and Forensics

  In this lesson, you’ll learn about: Windows Prefetch and forensic execution tracking1. What is Windows Prefetch?

  • A Windows performance feature designed to:
    • Speed up application startup
    • Reduce disk access time

  🔹 Key Idea

  • It becomes a forensic artifact that records program execution

  2. How Prefetch Works

  • Windows monitors the first seconds of an application launch
  • It records:
    • Files accessed
    • Execution behavior patterns

  👉 Result:

  • A cached “startup map” is created for faster future runs

  3. Prefetch File Structure🔹 Naming Format

  • Application name + hash
  • The hash is an 8-character hexadecimal value

  🔹 Purpose of the Hash

  • Derived from the application path
  • Helps differentiate:
    • Same program in different locations

  👉 Key Insight:

  • Same executable in different folders = different Prefetch file

  4. Forensic Value of Prefetch🔹 What investigators can determine

  • When a program was executed
  • How many times it was run
  • Whether it ran from unusual locations

  5. The “Who, What, When” of Forensics🔹 Key Questions Answered

  • Who: Which program was executed
  • What: Which executable was run
  • When: Last execution timestamp

  👉 Important:

  • Prefetch is one of the strongest execution evidence sources in Windows

  6. Detecting Evidence Tampering🔹 Critical Insight

  • Presence of cleanup tools is itself evidence

  🔹 Example

  • If a wiping tool appears in Prefetch:
    • It proves the tool was executed

  👉 Key Idea:

  • “Trying to hide evidence” becomes evidence itself

  7. Hidden Activity Discovery🔹 Prefetch can reveal:

  • Hidden directories
  • External storage usage
  • Encrypted container activity

  🔹 Example targets

  • TrueCrypt volumes
  • External USB drives
  • Obfuscated folders

  8. System Evolution🔹 Related Windows Technologies

  • Superfetch
  • ReadyBoost

  👉 Purpose:

  • Improve system responsiveness and memory usage

  9. Registry Control of Prefetch🔹 Key Concept

  • Prefetch behavior can be enabled/disabled via registry settings

  🔹 Forensic Importance

  • Investigators check registry keys to see:
    • If Prefetch was disabled intentionally
    • If someone tried to hide activity

  10. Investigation Workflow🔹 How analysts use Prefetch

  1. Locate Prefetch files
  2. Extract execution metadata
  3. Analyze timestamps and counts
  4. Correlate with other artifacts

  Key Takeaways

  • Prefetch records application execution behavior for performance
  • It is a powerful forensic artifact for tracking user activity
  • File names include hashed execution paths
  • It can reveal hidden tools, drives, and user behavior
  • Disabling Prefetch may itself indicate suspicious activity

  Big PicturePrefetch helps investigators:👉 Move from “what exists on disk” → “what was actually executed”Mental Model

  • Program run → Prefetch created → Execution metadata stored → Timeline reconstructed

  
  
  You can listen and download our episodes for free on more than 10 different platforms:
  https://linktr.ee/cybercode_academy

  ...more

  

  ---