Digital Forensics: Reconstructing an Attack in Modern Web Apps

The talk starts from the problem that modern web applications rarely live on one system. They span CI/CD pipelines, container images, cloud services and SaaS tools, so the point where an intrusion began is often far from where its effects show up. The speaker frames digital forensics as evidence collection that must survive scrutiny, with a documented chain of custody, and separates it from incident response. Responders who reboot machines or wipe systems can destroy volatile evidence, so examiners need to work with them early.

The core of the session is a live demonstration on a Windows Server host where an unexpected local administrator account and an unknown running executable had been found. The analysis builds a timeline from user activity artifacts, recycle bin metadata and event logs, then checks the SAM registry hive to confirm which accounts belong to the local administrators group. A service configured with an unquoted executable path is identified as a likely hijack point, since Windows would run a planted program.exe from the C drive. IIS logs then show directory brute-forcing, a Python-driven POST request, and an ASPX web shell reached through an arbitrary file upload flaw in a vulnerable archiving product.

The practical takeaways are to image whole disks including unallocated space, check shadow copies and backups for earlier evidence, and look beyond the initial host to proxies, firewalls and databases. The speaker also stresses that a forensic report outlives the examiner and must be accurate, because it may reach boards or law enforcement.