About the Jon

I’m Jon Glass, and I work in digital forensics and incident response (DFIR).

This blog started in 2013 as a place to write down things worth doing twice. Over the years that has meant Windows forensic artifacts, Sysmon and process mapping, malware analysis, remote collection with PowerShell and Python, and more recently automating Microsoft Defender for Endpoint and building small tools like Spoke, Huddle and Recap. They’re all on the Tools page.

The name comes from the Lincoln line about spending the first four hours sharpening the axe. Here, it’s the ACKs.

You can also find: