All the
Work.

Full forensic acquisition of a USB drive using FTK Imager. Covers write-blocking, MD5/SHA1 hash verification, and evidence packaging following chain-of-custody standards.

Deep analysis of the NTFS Master File Table using Autopsy and MFTECmd. Recovered deleted file entries, examined timestamps, and traced artefacts across the Mantooth disk image.

Manual Windows Registry analysis on the Mantooth case image. Extracted user activity, installed programs, USB device history, and recently accessed files from key registry hives.

Extracted NTLM hashes from SAM and SYSTEM hives using pwdump7, then cracked recovered hashes with Ophcrack rainbow tables and Hash Suite. Documented account security findings.

Detected and extracted data concealed within GIF image files using the gif-steganography Python tool. Analysed pixel-level modifications and documented the hidden payload extraction workflow.

Acquired live memory using DumpIt and analysed the dump with Volatility 3. Ran 7 plugins including pslist, netscan, malfind, and cmdline to enumerate processes, network connections, and injected code.

Forensic examination of an Android 13 device using ADB. Extracted app data, call logs, SMS, and file system artefacts. Two network addresses redacted per privacy requirements.

Ingested and queried DNS log data in Splunk to identify suspicious lookups, high-frequency queries, and potential DNS tunneling indicators. Built SPL queries and documented findings.

Analyzed FTP server logs to detect unauthorized access attempts, brute force patterns, and unusual data transfer volumes. Correlated events to surface anomalous sessions.

Parsed and queried HTTP access logs to identify web scanning activity, suspicious user agents, unusual status code patterns, and potential web application attack attempts.

Investigated SSH authentication logs for failed login attempts, credential stuffing patterns, and successful logins from suspicious source IPs. Built detection queries and alerts.

Detected covert tunnel traffic patterns in log data — identifying signs of data exfiltration and C2 communication through protocols used to bypass perimeter controls.

Analyzed SMTP email server logs to identify spam campaigns, phishing relay attempts, unusual sending volumes, and spoofed sender patterns across the log dataset.

A comprehensive reference document compiled across all six Splunk SIEM projects — covering SPL syntax, search commands, visualization techniques, and detection query templates.

Real-time network traffic capture and analysis tool built with Python and Scapy. Captures live packets, decodes protocol headers, filters by type, and flags anomalies. Mirrors core SOC monitoring workflows.

Python-based port scanning tool for host reconnaissance. Scans TCP ports across a target range, identifies open services, and formats results for quick triage.

Demonstrates how dictionary-based credential attacks work by testing a wordlist against a target hash. Built for security awareness and educational purposes — shows why strong passwords matter.

Evaluates password strength against configurable criteria including length, complexity, common patterns, and entropy scoring. Returns a rated report with improvement suggestions.

Full implementation of the Caesar cipher with encode, decode, and brute-force break modes. Demonstrates classical cryptography principles and frequency analysis.

Bash-based log parsing utility that scans log files for configurable patterns — error codes, IP addresses, suspicious keywords. Outputs matched lines with timestamps and frequency counts.

Python projects including a full command-line TO-DO manager with persistent storage, and a Snake-Water-Gun game — demonstrating clean Python structure, input handling, and basic OOP.

Applied structured network hardening techniques to identify and close attack surface gaps. Evaluated firewall rules, access controls, and segmentation policies aligned with NIST guidelines.

Implemented OS hardening across Linux and Windows environments — disabling unnecessary services, configuring audit policies, applying least-privilege principles, and patch management reviews.

Deep-dived into OSI and TCP/IP layer communications to analyze how data traverses networks, enabling precise identification of malformed or suspicious packets in captured traffic.

Walked through a full NIST IR lifecycle — preparation, detection, containment, eradication, recovery, and post-incident activity — with documentation at each phase.

Conducted a structured security audit aligned with NIST CSF and ISO 27001, assessing controls, identifying gaps, and producing a prioritized findings report with remediation recommendations.