Digital Forensics and Security Operations

My work in live digital forensics, memory analysis, incident response, and telemetry analysis for identifying stealth software, injected processes, and unauthorized system modifications.

Screenshare Forensics & Memory Analysis

Screensharing involves freezing a suspected user session and triaging their system over remote inspection tooling (Discord, AnyDesk) to identify hidden, injected, or wiped cheats. Modern evasive software is engineered to bypass automated scanner utilities, requiring manual forensic artifact analysis.

Process Memory and JVM Inspection

Stealth clients inject into javaw.exe or attach dynamically via the Java Instrumentation API. During a live investigation, I inspect process memory and JVM thread state:

• Dumping process strings using System Informer to search for known cheat package paths, hook definitions, and obfuscated class names.
• Capturing running thread stacks with jstack to locate unmapped or external threads outside standard client and Fabric/Forge loaders.
• Checking open DLL handles and memory page allocations to identify injected dynamic libraries and unbacked memory regions.

Operating System Execution Artifacts

Even if a user deletes a binary before or during an investigation, the operating system records execution history across several persistent disk artifacts.

In C:\Windows\Prefetch, Windows creates a .pf hash file whenever an executable runs, recording execution counters and timestamps. When a binary is deleted, its corresponding prefetch file remains in this directory until rolled over.

The Background Activity Moderator (BAM) registry key located at SYSTEM\CurrentControlSet\Services\bam\State\UserSettings logs full absolute file paths and timestamps for binaries run by each user account.

On NTFS filesystems, the USN change journal ($UsnJrnl) records filesystem transactions including creations, renames, and deletions. Parsing the journal reveals whether files were deleted immediately after a freeze command was issued.

Packet Timing and Telemetry Analysis

Automated defensive macros (such as autototem scripts) swap items into slots immediately upon damage. Differentiating legitimate human reaction from automated script execution requires analyzing packet intervals and timing variance:

• Human players exhibit physiological latency variance, typically between 80ms and 180ms, with irregular mechanical click spacing and input jitter.
• Automated scripts send packets at fixed millisecond offsets or zero-tick intervals, causing desynchronization alerts on server anti-cheat engines like TotemGuard.

Security Operations & Incident Response

• Cpvpprac Security Operations & Anti-Cheat Forensics
  On this competitive PvP practice server, I monitored live server telemetry and investigated anti-cheat alerts on TotemGuard. Because connection latency can trigger false flags, my role was to distinguish network packet drops from malicious packet injection, freeze suspected targets for screenshare forensic analysis, and issue network-level IP bans against ban-evading entities.
• Decree SMP and EgyPrac Server Security & Incident Investigation
  I led server security investigations handling player harassment, doxxing threats, and griefing attempts. By correlating account histories, Discord identifiers, and IP subnet ranges, I documented and banned threat actors while maintaining audit logging during competitive events.
• VanillaPvp Club Incident Response & Match Forensics
  I moderated competitive channels, resolved technical player disputes, reviewed recorded match footage for unnatural reach and angle anomalies, and enforced server-wide security standards.

Mechanical Integrity & Tier Testing

In competitive Minecraft CPvP (Crystal PvP), players duel tier testers to earn verified placements on community tier lists. I tested applicants on the Vanilla Tier List (VTL), Light Tiers, and Lunar Tiers to assign verified tier rankings (LT5 to HT3), with a personal peak of High Tier 3 (HT3) Vanilla (currently Low Tier 3 (LT3)).

During tier-tests, I benchmarked player mechanics:

• Evaluating placement cadence, anchor timing, and mechanical consistency against human biological thresholds.
• Screening client inputs and behavior for anomalous reach distances, triggerbots, and memory-resident modifications.