Best Clue Software Podcasts (2025)

Mark Button – Inside West Africa’s cybercrime ‘kingdoms’ Join Thomas for a revealing conversation with Professor Mark Button, Director of the Centre for Cybercrime and Economic Crime at the University of Portsmouth, as they delve into the hidden world of global fraud and the rise of sophisticated scam networks across West Africa. Drawing on years o…

1
DFSP # 487 Unmasking Malicious Activity with 4688 13:51

Play Pause

10d ago13:51

13:51

1
DFSP # 486 Squid Games 19:35

17d ago19:35

19:35

1
Laura Eshelby: The new age of fraud - and how to fight it 48:08

23d ago48:08

48:08

Join Thomas for a compelling conversation with Laura Eshelby, former Cabinet Office counter fraud leader, as she unpacks two decades on the front lines of the UK’s fight against fraud. Starting her career as a graduate trainee and auditor, Laura quickly rose through the ranks to lead complex financial investigations into high-value legal aid fraud.…

1
DFSP # 485 Certifiably Suspicious 14:00

24d ago14:00

14:00

1
DFSP # 485 BAM! Packing Punch 10:58

1M ago10:58

10:58

This week, I delve into the Windows BAM artifact, unraveling its forensic significance and exploring how it can unlock critical insights in digital investigations.

1
Nick Sharp – Inside the UK’s war on economic crime 52:20

1M ago52:20

52:20

Join Thomas for a revealing conversation with Nick Sharp, Deputy Director of the National Economic Crime Centre (NECC), as they unravel the hidden web of fraud and financial crime that’s costing the UK billions every year. From romance scams and impersonation fraud to international laundering networks stretching from Southeast Asia to West Africa, …

1
DFSP # 483 Cooking up Forensics with Chef 14:36

1M ago14:36

14:36

In this week’s episode, I delve into strategies for integrating CHEF into your security investigations, unlocking new avenues for proactive defense and effective incident response.

1
DFSP # 482 Unlocking Clues from Bash and Hidden Keys 20:41

2M ago20:41

20:41

This week, we’re pulling back the curtain on SSH from a digital forensics perspective.

1
Martin Dubbey – From drug busts to the Sochi doping scandal 50:59

2M ago50:59

50:59

Join Thomas as he speaks with Martin Dubbey, a former UK drug liaison officer turned international investigator, whose career spans from narcotics investigations in Customs and Excise to exposing one of the most audacious doping scandals in modern sport. Martin shares how his transition into private investigation led him to work alongside whistlebl…

1
DFSP # 481 Triage outside the Core 20:08

2M ago20:08

20:08

In this week’s episode, I dive into rapid triage techniques for non-core Windows executables to uncover signs of malicious activity.

1
DFSP # 480 Hidden risks of nested groups 13:59

2M ago13:59

13:59

This week, I’m talking about nested groups in Windows Active Directory and the security risks they pose. Active Directory allows administrators to attach one group to another—often called nesting. While nesting can simplify account administration and permission management, it can also create real opportunities for attackers if...…

1
Sarah Lewis OBE OLY – From Olympic slopes to anti-doping pioneer 44:46

2M ago44:46

44:46

Join Thomas as he dives into a fascinating conversation with Sarah Lewis OBE OLY, Olympic ski racer turned Secretary General of the International Skiing Federation (FIS), where she spent over two decades leading one of sport’s most crucial but complex battles - anti-doping. From the explosive Lahti scandal in 2001 to the shocking revelations at the…

1
DFSP # 479 Scan, Score, Secure 15:48

2M ago15:48

15:48

One of the essential skill sets for a DFIR analyst is the ability to understand the impact of vulnerabilities quickly. In many IR scenarios, you may find a newly discovered vulnerability or receive a scan that flags multiple potential weaknesses. To stay efficient, you must...

1
DFSP # 478 SRUM 15:48

2M ago15:48

15:48

This week, we’re exploring the System Resource Usage Monitor (SRUM) – a powerful source of forensic data within Windows operating systems. First introduced...

1
DFSP # 477 SSH Triage 18:17

3M ago18:17

18:17

In this episode, our focus is on understanding how attackers achieve lateral movement and persistence through Secure Shell (SSH)—and more importantly, how to spot the forensic traces...

1
DFSP # 476 Service Host 22:43

3M ago22:43

22:43

In this episode, we’ll take a focused look at how to triage one of the most commonly targeted Windows processes: svchost.exe. While the methods in this series generally apply to all Windows core processes, svchost is an especially important case because attackers...

1
DFSP # 475 - Set the tone 20:08

3M ago20:08

20:08

Ransomware attacks move quickly, making your initial response crucial in minimizing impact. This episode outlines critical first steps, from isolating infected machines to gathering key information and initiating containment. Whether you’re a SOC analyst, incident responder, or the first to notice an attack, this framework is designed to help you r…

1
DFSP # 474 - Meta Paradise 13:20

3M ago13:20

13:20

Today’s episode explores Apple Spotlight and its extended metadata—a powerful yet often overlooked forensic tool in the Mac ecosystem. Spotlight plays a critical role in uncovering digital evidence on macOS. Both experienced forensic analysts and newcomers will find its capabilities essential. Let’s dive into the details.…

1
DFSP # 473 - Why all the BINs 21:13

4M ago21:13

21:13

BIN directories (short for binary) store command binaries like CD, PWD, LS, Vi, and CAT. Every platform has multiple BIN directories: two in the root directory and two in each user directory. This episode explains the types of files in these directories and the purpose of each BIN directory. I will also clarify which directories are typically used …

1
DFSP # 472 - Windows Usual Suspects 16:35

4M ago16:35

16:35

Modern Windows systems use a tightly coordinated sequence of core processes to establish secure system and user environments. DFIR investigators and incident responders must understand the interrelationships between processes such as Idle, SMSS, CSRSS, WININIT, and WINLOGON. Recognizing expected behaviors and anomalies in these steps is crucial for…

1
DFSP # 471 Mac Persistence 17:43

4M ago17:43

17:43

Today we’re talking all about MacOS AutoRun locations and how to spot persistence mechanisms. We’ll explore the ins and outs of property list files, launch daemons, system integrity protections, and the recent changes in macOS that can impact your forensic examinations...

1
DFSP # 470 The Windows Taskhosts 17:33

4M ago17:33

17:33

This week I'm talking about the three task hosts. These are Windows core files, and they share not only similar names, but similar functionality. Because of this, there is the potential for confusion, which may allow an attacker to leverage these similarities and mask they are malware. My goal in this episode is to demystify the three different tas…

1
DFSP # 469 Network Blocked Activity 21:59

5M ago21:59

21:59

Today’s episode is all about Windows event logs that record blocked network connections. Blocked network events are interesting because they might signal that an attacker’s secondary or tertiary toolset isn’t working as intended. That’s good news from a security standpoint...

1
DFSP # 468 Data Brokers & Ransomware 28:24

5M ago28:24

28:24

Today I cover an evolving threat in the cybersecurity world: data brokers. From a computer forensics standpoint, this threats pose unique challenges. While breaches capture headlines, data brokers play a major (and sometimes overlooked) role in fueling cybercrime. In this session, we will explore how these threats operate, why they are dangerous, a…

1
DFSP # 467 CVSS in Action 28:31

5M ago28:31

28:31

The Common Vulnerability Scoring System (CVSS) is a powerful tool for assessing the severity and impact of security vulnerabilities. In digital forensics and incident response, CVSS scores can provide critical context to prioritize investigations and focus on the most significant risks. This episode I will explore how leveraging CVSS scoring enhanc…

1
DFSP # 466 Malware Triage for File Types 23:54

5M ago23:54

23:54

Understanding the behavior and characteristics of common file types used in attacks, such as executables, scripts, and document files, is essential for effective analysis. In this episode, we will explore practical approaches to triage malware, focusing on key indicators and techniques for prioritizing investigations.…

1
DFSP # 465 Network Permit Events 23:43

5M ago23:43

23:43

Windows permit events, often overlooked, offer valuable details about allowed network connections that can reveal patterns of malicious activity. In this episode, we will dive into how analyzing these events can enhance network triage, enabling security teams to detect, scope, and respond to threats more effectively.…

1
DFSP # 464 Risk Assessments for DFIR 22:30

6M ago22:30

22:30

Security risk assessments can be a tool for guiding and prioritizing incident response investigations. By evaluating the potential impact and likelihood of various threats, these assessments provide a structured framework to identify and mitigate risks effectively. This episode will explore how integrating security risk assessments into incident re…

1
DFSP # 463 Prefetch 14:45

6M ago14:45

14:45

This week, we’re focusing on the Windows Prefetch artifact—a cornerstone in Windows forensics, especially for user endpoint investigations. In this episode, I’ll break down the Prefetch artifact from an investigative perspective, covering how to effectively leverage its evidence in forensic analysis. I’ll also highlight any recent changes to the ar…

1
DFSP # 462 Malware Triage Part 1 29:32

6M ago29:32

29:32

This week, we’re exploring malware triage techniques. Unlike full binary analysis, malware triage is often seen as an essential skill that every digital forensic and incident response professional should master. In this episode, I’ll walk you through the core elements of malware triage, helping you understand the various skills needed to meet indus…

1
DFSP # 461 PSEXEC 16:50

6M ago16:50

16:50

This week, we’re diving into how to triage for PSEXEC evidence. PSEXEC leaves traces on both the source and target systems, making it essential to identify artifacts on each to determine whether a system was used as an attacker’s tool or was the target of an attack. While PSEXEC has somewhat fallen out of favor due to increased use of PowerShell fo…

1
DFSP # 460 Executing Linux 17:55

7M ago17:55

17:55

Understanding how to search for executables is a critical skill in computer forensics. There are major differences in how executables are handled between Windows and Linux systems, so techniques that work on Windows won’t always translate effectively to Linux. In this episode, I’ll break down some triage techniques to help you quickly identify susp…

1
DFSP # 459 listening ports 26:40

7M ago26:40

26:40

Welcome to today’s episode! We’re diving into network triage, focusing specifically on listening ports. While we often look for active connections, identifying suspicious services listening on a port can be equally crucial in your investigation. It’s essential to gather this information for both current, real-time data and historical analysis, prov…

1
DFSP # 458 Shellbags and PCA 18:11

7M ago18:11

18:11

In this episode, we’ll dive into two essential forensic artifacts in Windows: shellbags and the Program Compatibility Assistant (PCA). Shell bags provide valuable evidence of file and folder access, offering insights into user activity and file navigation. We’ll also explore PCA, which can reveal important information about file execution history. …

1
DFSP # 457 WSL 25:52

7M ago25:52

25:52

The Linux subsystem for Windows, create both opportunity and challenges for forensic analysts. It makes Windows an excellent platform for multi platform forensic analysis tasks, allowing it to take advantage of the many Linux tools available. The challenges are foreseeable, you have Linux artifacts, now commingled on a Windows platform, which makes…

1
DFSP # 456 network triage primer 32:05

8M ago32:05

32:05

In this episode, we’ll explore the fundamentals of network triage, focusing on the key aspects of network traffic that are central to many investigations. Additionally, we’ll discuss some of the essential tools you can use to analyze and manage network data effectively.

1
DFSP # 455 Security Control Circumvention 33:29

8M ago33:29

33:29

Today, we’re going to explore how to handle a critical security event: Unauthorized Modification of Information. This type of event occurs when a user alters information in a system—whether it’s an application, database, website, server, or configuration files—without prior authorization. These modifications can range from impersonation and unautho…

1
DFSP # 454 MFA Bypass Attacks 15:30

8M ago15:30

15:30

This week I talk about the attack methods being used to bypass MFA. We'll learn about real-world cases where MFA was circumvented, and discover best practices to strengthen defenses against these types of attacks...

1
DFSP # 453 Windows Startup Locations 18:19

8M ago18:19

18:19

In today’s episode, we’ll focus on startup folders, which are perhaps the easiest to triage among all persistence mechanisms. But before diving in, let’s recap the journey so far to underscore the importance of a comprehensive approach rather than a one-off tactic. Each triage area we've covered plays a crucial role in identifying and stopping atta…

1
DFSP # 452 AI and DFIR 22:02

9M ago22:02

22:02

In 2024, AI has not only revolutionized how we defend against cyber threats but also how those threats are being carried out. We'll explore how AI is enabling faster, more efficient security incident responses, with real-world examples of its application in automated threat detection and response, advanced forensics, and more. But with every techno…

1
DFSP # 451 SQL Triage 26:26

9M ago26:26

26:26

SQL injection poses significant risks by enabling attackers to access sensitive metadata, execute dynamic SQL commands, and alter system parameters. These actions can lead to unauthorized data access and system disruptions, especially if attackers gain elevated privileges. This week I'm talking about SQL attack patterns from a triage point of view …

1
DFSP # 450 Secure coding and DFIR 19:34

9M ago19:34

19:34

I decided to talk this week about the Importance of Secure Coding Knowledge for Security Incident Response Investigations. Knowing secure coding principles helps identify the root causes of vulnerabilities and recognize attack patterns. It facilitates effective communication and collaboration with developers, ensuring accurate incident reports and …

1
DFSP # 449 Zero-Day or Hero-Day 33:43

9M ago33:43

33:43

This week, we're covering zero-day vulnerability response from a Digital Forensics and Incident Response professional's perspective. In our roles, we often get involved in various tasks that require a security mindset, and one critical task is responding to zero-day vulnerabilities. To provide a real-world context, we'll integrate the recently disc…

1
Ian Smith: Esports – a game-changer for sports integrity? 1:04:25

9M ago1:04:25

1:04:25

In this episode, Ian Smith, Commissioner of the Esports Integrity Commission (ESIC), explores the fast-growing world of esports and its integrity challenges. Drawing from his experience tackling match-fixing in cricket, Ian explains his move into esports, where competitive gaming has surged in popularity, with players earning significant incomes an…

1
DFSP # 448 WebShell Forensics 20:14

9M ago20:14

20:14

Welcome to this week’s session, where we’ll delve into web shell forensics—an ever-critical topic in incident response investigations and threat-hunting strategies. Today, I’ll provide a breakdown that includes the latest developments, detailed triage techniques, and practical examples of what to look for during your investigations:…

1
DFSP # 447 Linux Root Kits 32:39

10M ago32:39

32:39

Rootkits are hard to detect because they employ advanced stealth techniques to hide their presence. They can conceal processes, files, and network activities by altering system calls and kernel data structures. The deep system knowledge and specialized tools required for low-level analysis make rootkit detection complex and resource-intensive. Limi…

1
Neville Blackwood – On the frontlines of global law enforcement 58:48

10M ago58:48

58:48

In this episode, Thomas sits down with Neville Blackwood, a seasoned international law enforcement consultant and former senior police officer, to delve into the complexities of global policing. Neville recounts his journey from joining Thames Valley Police in 1982 to leading undercover operations against organised crime in Europe, which fueled his…

1
DFSP # 446 Registry by EVTX 20:02

10M ago20:02

20:02

In previous episodes, we covered techniques for examining the Windows Registry, a critical component in identifying persistence mechanisms. We'll explore the registry but shift our focus to registry modification events as reported by Windows event logs