Using Windows Task Manager, I acquired the Chromium-based browser's process memory and performed hexadecimal and string analysis with WinHex, identifying credential artifacts within the captured memory space. The experiment demonstrates how sensitive authentication data may persist in volatile memory, depending on browser memory allocation, application behavior, and acquisition timing. Memory indeed sits above disk. Key takeaway: TLS encrypts credentials in transit, but it does not eliminate potential plaintext exposure within endpoint memory.

Today in HIVE Consult’s Pentest and DFIR Lab, Instructor @elormkdaniel demonstrated how our forensic box can be used during a mobile device investigation. The BlockBox helps isolate a phone or laptop from cellular, Wi‑Fi and Bluetooth signals while investigators handle it. This reduces the risk of incoming messages, remote commands or a remote wipe changing potential evidence. Elorm’s demonstration shows why protecting a device’s state is an essential first step in a mobile investigation. Follow our LinkedIn page: linkedin.com/company/hivesec… Thank you💚

Let me take you through some devices in our New Pentest and Digital Forensics Lab. A digital forensics laboratory lab especially cannot be considered complete without the right evidence-acquisition, preservation and analysis equipment. Our laboratory is now equipped with: 1. TX1 Forensic Imager — Brand New
Used for high-speed forensic imaging and duplication of digital storage devices while maintaining evidence integrity. 2. Digital Intelligence BlackBox — Brand New
A powerful forensic workstation designed to process and analyse large volumes of digital evidence efficiently. 3. FRED Forensic Workstation 
A specialised system built for forensic acquisition, examination, recovery and analysis of digital evidence. 4. 20 Faraday Bags — Brand New
Used to isolate mobile devices from cellular, Wi-Fi, Bluetooth and other wireless signals, preventing remote access, alteration or deletion of evidence. 5. 11 Hardware Write Blockers — Brand New
Allow investigators to access and acquire data from storage devices without modifying the original evidence. 6. WiFi Pineapple Mark VII — Brand New
A specialised wireless security auditing device used to assess Wi-Fi networks, identify insecure configurations, detect rogue access points and demonstrate wireless attack risks during authorised penetration tests. 7. O.MG Cable — Brand New
A security-testing cable designed to demonstrate how modified USB cables can be used as covert attack tools. It helps organisations evaluate endpoint security, employee awareness and protection against malicious peripheral devices in controlled environments. 8. RFID/NFC Card Cloners — Brand New
Used during authorised physical-security assessments to examine access cards, identify weak RFID or NFC technologies and demonstrate the risks of insecure credential duplication. They are also useful for testing whether access-control systems can detect cloned or unauthorised cards. A proper pentest and digital forensics laboratory requires more than software and ordinary computers. It must have dedicated equipment for the lawful pentest, acquisition, protection, preservation, examination and analysis of digital evidence. These are just a few hardwares out of the many in our closet though😂✊🏽.