jq is super useful, once somebody explains the basics to you. Here I am explaining the basics in a way that's applicable for all you DFIR types.
https://righteousit.com/2026/04/06/jq-for-forensics/
#JSON #DFIR #Linux
Hal Pomeranz
npub1u4…fj97u
2026-04-06 18:41:02 UTC
Author Public Key
npub1u47m4y2sckmqcvhfj4rk7v2lu6s8uy04e5uy62pxwrw2xd8ymehs7fj97uSeen on
wss://relay.momostr.pinkPublished at
2026-04-06 18:41:02 UTCEvent JSON
{
"id": "807190fe3e94ec27b4bbf6e986029ad8f9ba38533b06f9f7e6bc040dd309f5a0",
"pubkey": "e57dba9150c5b60c32e995476f315fe6a07e11f5cd384d282670dca334e4de6f",
"created_at": 1775500862,
"kind": 1,
"tags": [
[
"t",
"linux"
],
[
"t",
"dfir"
],
[
"proxy",
"https://infosec.exchange/@hal_pomeranz/116359224529096101",
"web"
],
[
"t",
"json"
],
[
"proxy",
"https://infosec.exchange/users/hal_pomeranz/statuses/116359224529096101",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/hal_pomeranz/statuses/116359224529096101",
"pink.momostr"
],
[
"-"
]
],
"content": "jq is super useful, once somebody explains the basics to you. Here I am explaining the basics in a way that's applicable for all you DFIR types.\n\nhttps://righteousit.com/2026/04/06/jq-for-forensics/\n\n#JSON #DFIR #Linux",
"sig": "ef2c2b4bf308385829836196b2c588bd3ac82ecf1eb264f2c7ef6072715002de5683e8c4d48ce38175061f06cff584a649ed0c3beb4d58f98e0ddcda1331b802"
}