Full technical accounts of cases our digital forensics and incident response team has worked. Each one is written end to end — what we measured, what failed, and what it changed — for readers who are not reverse engineers. Client and victim identifiers are masked; full values stay in the access-controlled law-enforcement packs.