Workshop · preview
Forensics with Mutant
A path from first program to a full case. Every program shown here is a file from Mutant v2.6.1. Output marked recorded is a real run of that file; output marked simulated shows what the program prints on the case evidence, for teaching. Modules marked preview are complete but not yet published.
The path
-
Introduction
Why a forensics language, and what a Mutant program looks like end to end.
-
Intro to the language
Eight short sections: bindings, value and error pairs, closures, loops, higher-order functions, control flow, structs and enums, macros.
-
Artefact modelling
Turning raw evidence into typed records a pipeline can reason about.
-
Timestomping
Two clocks in every MFT record, and the test that catches a file whose times were rewritten.
-
Malware in ads
Following a redirect chain through browser history, and the cookies each hop left behind.
-
Registry persistence
Run and RunOnce keys: what Windows starts at logon, and how to spot the entry that does not belong.
-
Triage toolkit
Small, input-free snippets for indicators, encodings and fuzzy matching, each with its recorded output.
-
Capstone: QUILLDROP
One case, start to finish, using every technique on the path.
Your progress
Progress is kept in this browser only and is never sent anywhere. The course here and the glyph in the footer share it.