🎉 Big news! Investigating macOS Endpoints is now live—plus our new *NIX Bundle and XPlat Bundle Complete (all 13Cubed courses in one package). Thanks for patiently waiting! Dive in now 👉 #DFIR #macOS #Linux.

🛑✋ Well, that was fast! The contest is now closed, and all 5 winners have been selected and notified. Of course, the challenge will remain available and will hopefully serve as a great study resource for a long time to come.

Happy summer! ☀️ Ready for a new 13Cubed memory forensics challenge? You could win an official 13Cubed challenge coin. 🎉 Check it out here! #DFIR.

This Monday, we’re dropping a new memory forensics challenge—this time focused on Windows! Like the last Linux one, you’ll have a chance to win a 13Cubed Challenge Coin. Subscribe at and click the 🔔 so you’re notified!.

We just issued our 500th 13Cubed certification! 🎉 Learn more at All Windows, Linux, and macOS courses include certification attempts at no extra cost, allowing you to demonstrate real-world practical application of forensic investigative techniques. 🏅

Windows forensics is essential—but don’t overlook Linux or macOS. These platforms are steadily gaining ground in enterprise environments. Make sure you have the skills you need to investigate them too!.

🙏🎉.

🎉 It’s time for a new 13Cubed episode! We’ll briefly explore how process hollowing works and check out the relatively new windows.hollowprocesses plugin for Volatility 3. There are also two memory samples you can download for practice! #DFIR.

🎉 Happy Friday! Two quick updates:. Investigating macOS Endpoints and related bundles are now open for waitlisting! 👉 13Cubed Merch Store is LIVE with fresh designs and premium shirts! 👉

It's time for a new 13Cubed episode! 🎉 This is a small excerpt from one of the lessons in the upcoming "Investigating macOS Endpoints" course. Look for the course release this summer! #DFIR #macOS.

It's time for a new 13Cubed episode covering a very obscure evidence of execution artifact. Enjoy! #DFIR.

Happy New Year! 🎉🥳 The first 13Cubed episode of 2025 is here! Let's explore some groundbreaking research from CyberCX on “rewinding the NTFS USN Journal.” #DFIR.

Happy Friday the 13th! 🎉 We’re thrilled to share that our next 13Cubed course—Investigating macOS Endpoints—is officially in the works. This highly requested training is now our top priority, with a target launch by mid-2025. We'll keep you updated along the way! #DFIR

Happy Cyber Monday! 🎉 A brand-new 13Cubed episode on NTFS FILE record reuse is out now. Dive into the details and don’t forget—today’s the final day to save 13% on all 13Cubed training courses with code BLACKFRIDAY2024. Ends at 00:00 UTC Dec 3. #DFIR.

🎉🦃 The 13Cubed Black Friday sale is now live through Monday. Use coupon code BLACKFRIDAY2024 to save 13% -- our biggest promotion of the year. #DFIR.

🎉🦃 Our annual Black Friday sale starts Friday, November 29, and runs through Monday, December 2. All courses and bundles will be 13% off for individual purchases. Standard bulk discount rates apply. #DFIR.

I just released an update to Skeebus, my macOS GeoIP menu bar app. Check it out! #macOS.

13Cubed is on Bluesky at Give us a follow!.

🎃 Happy Halloween! 🎃. Here's a not-so-scary poll for you! The question is about the next 13Cubed Training Course. What do you want to see in 2025? #DFIR.

A new mega 13Cubed episode is out now! Dive into KG Distribution, the 13Cubed + XINTRA Labs (@XintraOrg) Windows memory forensics challenge, and learn how to harness the power of MemProcFS in your investigations! #DFIR.