Created: Sunday, 27 January 2013
Updated: Sunday, 15 March 2026

<h2>Professional Experience</h2> <p>Since <strong>March 2012</strong>, I have worked as a <strong>Digital Forensics Examiner</strong>, handling a wide range of investigations, including:</p> <ul> <li>Copyright infringement </li> <li>Data breaches </li> <li>Hacking incidents (defacement, credential‑stealing malware, bitcoin‑stealing malware, cryptomalware) </li> <li>Theft of sensitive data (e.g., banking credentials) </li> <li>Tax evasion </li> <li>Money laundering </li> <li>Web fraud and financial fraud </li> </ul> <p>I have extensive experience with commercial forensic tools such as:</p> <ul> <li><strong>FTK</strong> </li> <li><strong>X‑Ways Forensics</strong> </li> <li><strong>Nuix Workstation</strong> </li> <li><strong>Magnet AXIOM</strong> </li> <li><strong>Oxygen Forensics</strong> </li> <li><strong>Cellebrite UFED Physical Analyzer</strong></li> </ul> <p>I also develop <strong>custom forensic tools</strong> when commercial solutions are insufficient.</p> <p>I have deep expertise in:</p> <ul> <li>Recovering <strong>RAID arrays</strong> without prior configuration information </li> <li>Analyzing <strong>DVR file systems</strong> (often proprietary or undocumented) </li> <li>Processing <strong>large‑scale log datasets</strong> containing millions of records </li> <li>Understanding <strong>Microsoft SQL Server storage internals</strong>, gained through extensive tax‑evasion casework </li> </ul> <hr /> <h2>Education</h2> <p>I hold a degree in <strong>Electrical and Computer Engineering</strong> from the <strong>Democritus University of Thrace, Greece</strong>.</p> <p>My <strong>master’s thesis</strong> focused on:</p> <ul> <li>Statistical properties of popular internet applications </li> <li>Stress‑testing network interface cards and saturated network links </li> <li>Identifying traffic patterns using <strong>Fourier‑based analysis</strong> </li> </ul> <hr /> <h2>Software Development &amp; Automation</h2> <p>I develop tools capable of parsing <strong>documented and undocumented data structures</strong> directly from raw sources, including direct disk access. I also developed many forensic tools related to the file systems NTFS and BTRFS in golang.<br /> I use <strong>Python</strong> to automate repetitive tasks and to support electronic‑fraud investigations through:</p> <ul> <li>Email header analysis </li> <li>OSINT data collection </li> <li>Visualization of communication patterns </li> </ul> <hr /> <h2>Web, GUI, and Backend Development</h2> <p>I work with:</p> <ul> <li><strong>Flask</strong> for backend web development </li> <li><strong>PyQt</strong> and <strong>GTK+ 3</strong> for desktop GUI applications </li> </ul> <p>I have also developed tools for:</p> <ul> <li><strong>XML transformation</strong> </li> <li><strong>PDF report generation</strong> using XSL </li> </ul> <p>Backend technologies I have used include:</p> <ul> <li><strong>MySQL</strong> </li> <li><strong>Microsoft SQL Server</strong> </li> <li><strong>Redis</strong></li> </ul> <p>I follow established software engineering practices:</p> <ul> <li>Writing idiomatic, maintainable code </li> <li>Unit testing </li> <li>DRY</li> </ul>

VirusTotal Hashwindowsntfsraid EnCase6 unallocated policy MD5 directory entry $DATA forensics ntfsfat32CV recovered fileCV security file systems ADS $MFTpassword $mft

Understanding $DATA attribute

The following scenario demonstrates a potentially confusing situation you might face as an investigator. Knowing extensively the NFTS internals...

Password policies - Password creation

Designing a password policy for applications facing the internet has always been a hot issue. Basically, the decision to enforce a set of...

Recovering a deleted file from FAT32

Assume you use a forensic software that has recovered file system metadata of a deleted jpeg file from a FAT32 formatted volume with a cluster...

Reconstructing a RAID 5 that holds an NTFS volume without knowing its configuration.

To save readers' precious time I would like to emphasize the fact that that this guide applies in raids containing an NTFS formatted...

Questions on File Systems and Windows Forensics.

Below you will find questions that test your knowledge on this subject. I wrote them while I read material mainly from books in file systems...

VirusTotal EnCase6 Hash Set

For the examiners who wish to locate malware in EnCase 6 based on virus signature, I have downloaded the latest VirusTotal database and...

Built with...

In March 2024, all backed and client libraries are updated, and the site moved to python3.12 rutime.

In April 2023, this site was...

© 2012 - 2026 Armen Arsakian updated atSunday 15 March 2026Contact: contact at arsakian.com

-3184 . 5131