SOC & DFIR

Workflows and tooling for security analysts — phishing triage, forensics, and the small conversion and inspection tasks that come up in every investigation.

Articles

• Open Outlook .msg Files on Linux — convert .msg exports to .eml with msgconvert and inspect headers and body in any editor
• SPF Record Explained — what spf=pass really validates, reading Received-SPF, and checking any SPF record with dig
• DKIM Signature Check — decode every DKIM-Signature: tag and look up the public key via selector._domainkey.domain
• DMARC Alignment Explained — how alignment ties SPF and DKIM to the visible From:, and what p=none/quarantine/reject mean
• Create MD5 and SHA256 File Hashes — evidence-integrity hashing on Windows, macOS, and Linux, with verification steps