DFIR
Evidence-led digital forensics and incident response across complex environments.
forensic_analysis.exeField research portfolio
Ahmed Elessaway / xElessaway
Investigating the digital underground.
DFIR, OSINT, and threat intelligence research - turning scattered evidence into practical analysis.
Core competencies
Research, not noise.
OSINT
Open-source investigation, infrastructure pivots, and identity research.
sources to contextThreat Intel
Actionable reporting on campaigns, adversary tradecraft, and defensive signals.
research in progressField notes
Latest research
Exposed: QuickDAV Malware Distribution Repository and Remcos RAT Infrastructure
Passive acquisition review + offline static analysis of an exposed QuickDAV malware repository and Remcos RAT delivery infrastructure.
I Found a Stranger’s Phone. I Had No Way In. So, I Built One.
A real story about mobile forensics, FRP bypass, chipset research, and passive OSINT, all in service of getting a phone back to its owner.
One Facebook Message Exposed a $100M Crypto Fraud Network. Here’s How
OSINT investigation mapping a fake crypto exchange fraud network from one Facebook lure to DNS, backend, certificate, and WebSocket infrastructure.
Practice lab
Build analyst instincts through hands-on challenges.
Explore structured OSINT and DFIR practice collections, with repeatable scenarios and clear solving paths.
Open practice lab