The Clipdex Project

2026-08-14· 18 min read
The Clipdex Project

Here is the English translation of that section:

Hello.

I wanted to review some sections of a Linux Kernel Internals course. I already knew that Abolfazl Kazemi had uploaded courses on YouTube on his os_security channel. I checked his channel and noticed that the Linux Kernel Internals course he posted was incomplete—it was actually part of a broader Linux Internals and Forensics course that hadn't been published on any platform. I messaged him about it, and he explained that the full course files were uploaded to a Telegram channel. You can download them here.

However, the course was quite detailed and focused mainly on forensics, whereas I was only looking to watch specific parts. Manually finding topics across so many video files (13 sessions, two files each) and long videos (~1.5 hours per file) was difficult. Therefore, I decided to write a tool to generate this index for me.

I used Grok 4.6 (just a day after its release). The algorithm I followed was simple:

  • Extract the transcript of each video using a speech-to-text model that supports Persian (such as mlx-whisper or openai-whisper).
  • Pass the transcripts along with timestamps to an LLM to categorize the topics.
  • Display the topics and timestamps with clickable links so the player seeks directly to the start of each topic.

The result of this effort became the Clipdex project. I was pleased with how it turned out, so I wanted to publish it—hopefully, it will be useful to others as well. You can check out the project here on GitHub and use it if you like. If you encounter any issues or have suggestions for improvements or developments, feel free to open an issue. I'd be happy to check it out!

Image
Image
Image
Image

P.S.: I'm also sharing the topic index generated for this course below. If you don't feel like running the tool yourself, you can still use this index directly:

# linux internal forensics topics index

55 topics · 137 clips

## Topics

### /proc filesystem

- /proc filesystem · Session 01 · S01-P1.mp4 · `00:42:15` – `00:52:22`

### Assembly

- x86 registers and flags · Session 01 · S01-P2.mp4 · `00:09:45` – `00:23:58`
- Assembly instructions · Session 01 · S01-P2.mp4 · `00:23:58` – `00:38:58`

### Bash history

- Bash history · Session 09 · S09-P2.mp4 · `00:12:29` – `00:28:02`

### bpftrace

- bpftrace · Session 07 · S07-P1.mp4 · `00:47:42` – `00:57:18`

### bulk_extractor

- bulk_extractor · Session 09 · S09-P1.mp4 · `00:38:57` – `00:46:59`

### Calling convention

- 32-bit calling convention · Session 01 · S01-P2.mp4 · `00:38:58` – `01:18:16`
- Stack frames · Session 02 · S02-P1.mp4 · `00:00:00` – `00:27:23`
- x64 calling convention · Session 02 · S02-P2.mp4 · `00:11:57` – `00:25:01`

### Case studies

- Apache honeypot case · Session 13 · S13-P1.mp4 · `01:04:57` – `01:27:18`
- icat file recovery · Session 13 · S13-P2.mp4 · `00:00:00` – `00:07:41`
- Process environment pivoting · Session 13 · S13-P2.mp4 · `00:07:41` – `00:21:16`
- Apache log analysis · Session 13 · S13-P2.mp4 · `00:21:16` – `00:43:17`

### Copy-on-write

- Copy-on-write · Session 12 · S12-P2.mp4 · `00:44:56` – `00:51:28`

### Course intro and syllabus

- Course intro and syllabus · Session 01 · S01-P1.mp4 · `00:00:00` – `00:10:59`

### Digital forensics

- Digital forensics · Session 08 · S08-P1.mp4 · `00:00:00` – `00:22:35`

### Disk imaging

- dd disk imaging · Session 12 · S12-P1.mp4 · `00:15:23` – `00:40:38`
- Mounting disk images · Session 12 · S12-P1.mp4 · `00:40:38` – `00:47:59`

### Disk partitions

- Master boot record · Session 11 · S11-P2.mp4 · `00:51:41` – `01:12:30`
- MBR partition table · Session 12 · S12-P1.mp4 · `00:00:00` – `00:15:23`
- Extended partitions · Session 12 · S12-P1.mp4 · `00:47:59` – `00:53:32`
- GPT partition layout · Session 12 · S12-P1.mp4 · `01:11:51` – `01:19:12`
- GPT partition parsing · Session 12 · S12-P2.mp4 · `00:00:00` – `00:12:15`

### eBPF

- eBPF · Session 07 · S07-P1.mp4 · `00:41:08` – `00:47:42`

### ELF format

- Compilation pipeline and ELF · Session 01 · S01-P1.mp4 · `00:10:59` – `00:27:47`
- ELF overview · Session 11 · S11-P1.mp4 · `00:00:00` – `00:13:45`
- ELF header · Session 11 · S11-P1.mp4 · `00:13:45` – `00:26:54`
- Entry point · Session 11 · S11-P1.mp4 · `00:26:54` – `00:32:25`
- Program headers · Session 11 · S11-P1.mp4 · `00:32:25` – `00:49:57`
- Segment types · Session 11 · S11-P1.mp4 · `00:49:57` – `01:12:57`
- Section headers · Session 11 · S11-P1.mp4 · `01:12:57` – `01:21:26`
- Section headers · Session 11 · S11-P2.mp4 · `00:00:00` – `00:13:37`
- Section types · Session 11 · S11-P2.mp4 · `00:13:37` – `00:26:53`
- Dynamic linking · Session 11 · S11-P2.mp4 · `00:26:53` – `00:32:41`
- PLT and GOT · Session 11 · S11-P2.mp4 · `00:32:41` – `00:51:41`

### Encrypted containers

- Encrypted containers · Session 09 · S09-P1.mp4 · `00:46:59` – `01:01:08`

### Endianness

- Endianness · Session 01 · S01-P1.mp4 · `01:18:50` – `01:30:46`

### ext4

- ext filesystem blocks · Session 12 · S12-P2.mp4 · `00:51:28` – `01:03:15`
- ext4 on-disk layout · Session 13 · S13-P1.mp4 · `00:00:00` – `00:12:15`
- ext4 block groups · Session 13 · S13-P1.mp4 · `00:12:15` – `00:23:47`
- ext4 superblock · Session 13 · S13-P1.mp4 · `00:23:47` – `00:42:35`
- Inode number gaps · Session 13 · S13-P1.mp4 · `00:42:35` – `00:49:41`

### File integrity checks

- File integrity checks · Session 06 · S06-P1.mp4 · `00:00:00` – `00:09:25`

### Firefox history

- Firefox history · Session 09 · S09-P2.mp4 · `00:43:46` – `00:53:35`

### ftrace

- ftrace · Session 05 · S05-P2.mp4 · `00:26:52` – `00:42:00`
- function_graph · Session 05 · S05-P2.mp4 · `00:42:00` – `01:01:12`
- ftrace events · Session 05 · S05-P2.mp4 · `01:01:12` – `01:16:15`
- VFS ftrace recap · Session 06 · S06-P1.mp4 · `00:09:25` – `00:16:51`
- ftrace hooks · Session 06 · S06-P1.mp4 · `00:16:51` – `00:42:46`

### GDB

- GDB · Session 01 · S01-P1.mp4 · `00:52:22` – `01:18:50`

### GDB extensions

- GDB extensions · Session 01 · S01-P2.mp4 · `00:00:00` – `00:09:45`

### Incident response

- Incident response · Session 08 · S08-P1.mp4 · `00:22:35` – `00:32:07`

### IPC

- IPC · Session 06 · S06-P2.mp4 · `00:47:45` – `00:57:19`

### Journaling

- Journaling · Session 12 · S12-P2.mp4 · `00:39:00` – `00:44:56`

### Kernel build

- Kernel config and build · Session 02 · S02-P2.mp4 · `00:56:35` – `01:10:18`
- Booting custom kernel · Session 02 · S02-P2.mp4 · `01:10:18` – `01:16:30`
- Kernel config and build · Session 03 · S03-P1.mp4 · `00:24:43` – `01:05:42`
- Kernel GDB symbols · Session 03 · S03-P1.mp4 · `01:17:44` – `01:25:35`

### Kernel modules

- Kernel modules · Session 04 · S04-P2.mp4 · `00:00:00` – `00:09:10`
- Hello kernel module · Session 04 · S04-P2.mp4 · `00:09:10` – `00:29:20`
- EXPORT_SYMBOL · Session 04 · S04-P2.mp4 · `00:34:06` – `00:46:02`
- procfs module · Session 05 · S05-P2.mp4 · `00:11:28` – `00:26:52`
- Hidden kernel modules · Session 09 · S09-P1.mp4 · `00:27:20` – `00:38:57`

### Kernel source browsing

- Kernel source browsing · Session 02 · S02-P2.mp4 · `00:45:13` – `00:56:35`

### Kernel threads

- systemd · Session 07 · S07-P1.mp4 · `00:57:18` – `01:16:50`
- PID 1 boot · Session 07 · S07-P2.mp4 · `00:00:00` – `00:08:31`
- Kernel threads · Session 07 · S07-P2.mp4 · `00:08:31` – `01:05:24`

### Linux filesystem types

- Linux filesystem types · Session 12 · S12-P2.mp4 · `00:34:28` – `00:39:00`

### Linux kernel intro

- Linux kernel intro · Session 02 · S02-P2.mp4 · `00:25:01` – `00:45:13`

### Linux malware

- Symbiote · Session 13 · S13-P2.mp4 · `00:43:17` – `00:48:47`
- BPFDoor · Session 13 · S13-P2.mp4 · `00:48:47` – `00:56:13`

### Live forensics

- Live investigation · Session 08 · S08-P1.mp4 · `00:32:07` – `00:41:40`
- netcat transfer · Session 08 · S08-P1.mp4 · `00:41:40` – `00:50:54`
- Logger scripts · Session 08 · S08-P1.mp4 · `00:50:54` – `01:18:57`
- Sample log analysis · Session 08 · S08-P2.mp4 · `00:00:00` – `00:16:52`
- Live investigation · Session 08 · S08-P2.mp4 · `00:16:52` – `00:28:38`
- Live investigation · Session 09 · S09-P1.mp4 · `00:00:00` – `00:06:41`

### Memory corruption

- Section permissions and W^X · Session 01 · S01-P1.mp4 · `00:34:19` – `00:42:15`
- Format string vulnerability · Session 02 · S02-P1.mp4 · `00:27:23` – `00:36:54`
- Compiler mitigations · Session 02 · S02-P1.mp4 · `00:36:54` – `00:47:04`
- PIE and ASLR · Session 02 · S02-P1.mp4 · `00:47:04` – `01:04:35`
- Out-of-bounds write · Session 02 · S02-P1.mp4 · `01:04:35` – `01:27:04`
- Stack buffer overflow · Session 02 · S02-P2.mp4 · `00:00:00` – `00:11:57`

### Memory forensics

- Memory acquisition · Session 08 · S08-P2.mp4 · `00:28:38` – `00:36:23`
- LiME · Session 08 · S08-P2.mp4 · `00:36:23` – `00:46:19`
- Volatility profiles · Session 08 · S08-P2.mp4 · `00:46:19` – `01:09:50`
- Volatility 3 ISF · Session 09 · S09-P1.mp4 · `00:06:41` – `00:27:20`
- MemProcFS · Session 10 · S10.mp4 · `00:00:00` – `00:13:58`

### OOM killer

- OOM killer · Session 07 · S07-P2.mp4 · `01:05:24` – `01:13:47`

### Open files

- Open files · Session 09 · S09-P2.mp4 · `00:28:02` – `00:43:46`

### POSIX shared memory

- POSIX shared memory · Session 06 · S06-P2.mp4 · `00:57:19` – `01:11:54`

### Process sandboxing

- Process sandboxing · Session 07 · S07-P1.mp4 · `00:08:17` – `00:12:34`

### Processes

- task_struct · Session 05 · S05-P1.mp4 · `00:50:39` – `01:04:08`
- fork and clone · Session 05 · S05-P1.mp4 · `01:04:08` – `01:22:46`
- Task linked list · Session 05 · S05-P2.mp4 · `00:00:00` – `00:11:28`
- Signal handling · Session 06 · S06-P1.mp4 · `00:42:46` – `00:53:18`
- Process states · Session 06 · S06-P1.mp4 · `00:53:18` – `01:01:13`
- Zombie processes · Session 06 · S06-P1.mp4 · `01:01:13` – `01:20:00`

### pslist and psenv

- pslist and psenv · Session 09 · S09-P2.mp4 · `00:00:00` – `00:12:29`

### QEMU lab

- QEMU virtio disk · Session 03 · S03-P1.mp4 · `01:05:42` – `01:17:44`
- QEMU tap networking · Session 03 · S03-P2.mp4 · `00:00:00` – `00:10:29`

### Scheduling

- Task scheduling · Session 06 · S06-P2.mp4 · `00:00:00` – `00:10:36`
- Scheduling policies · Session 06 · S06-P2.mp4 · `00:10:36` – `00:18:17`
- task_struct priorities · Session 06 · S06-P2.mp4 · `00:18:17` – `00:47:45`
- Per-CPU runqueues · Session 07 · S07-P1.mp4 · `00:00:00` – `00:08:17`

### seccomp

- seccomp · Session 07 · S07-P1.mp4 · `00:12:34` – `00:41:08`

### setuid binary

- setuid binary · Session 09 · S09-P2.mp4 · `01:03:51` – `01:07:25`

### sk_buff packets

- sk_buff packets · Session 09 · S09-P1.mp4 · `01:01:08` – `01:11:34`

### Syscalls

- strace and ltrace · Session 03 · S03-P2.mp4 · `00:10:29` – `00:19:14`
- Syscall ABI · Session 03 · S03-P2.mp4 · `00:42:45` – `00:49:26`
- Assembly syscalls · Session 03 · S03-P2.mp4 · `00:49:26` – `01:06:55`
- Syscall recap · Session 04 · S04-P1.mp4 · `00:00:00` – `00:13:26`
- stat syscalls · Session 04 · S04-P1.mp4 · `00:13:26` – `00:32:03`
- Syscall ABI · Session 04 · S04-P1.mp4 · `00:32:03` – `00:51:29`
- sys_call_table · Session 04 · S04-P1.mp4 · `00:51:29` – `01:16:10`
- vdso and vsyscall · Session 04 · S04-P1.mp4 · `01:16:10` – `01:25:27`

### The Sleuth Kit

- The Sleuth Kit · Session 13 · S13-P1.mp4 · `00:49:41` – `00:58:38`

### TrueCrypt passphrase

- TrueCrypt passphrase · Session 09 · S09-P2.mp4 · `00:58:34` – `01:03:51`

### UAC collector

- UAC collector · Session 13 · S13-P1.mp4 · `00:58:38` – `01:04:57`

### UEFI Secure Boot

- UEFI Secure Boot · Session 12 · S12-P1.mp4 · `00:53:32` – `01:11:51`

### USB mount timeline

- USB mount timeline · Session 09 · S09-P2.mp4 · `00:53:35` – `00:58:34`

### User activity reconstruction

- User activity reconstruction · Session 09 · S09-P1.mp4 · `01:11:34` – `01:18:00`

### VFS

- File descriptors · Session 03 · S03-P2.mp4 · `00:19:14` – `00:42:45`
- Loop device · Session 04 · S04-P2.mp4 · `00:29:20` – `00:34:06`
- VFS · Session 05 · S05-P1.mp4 · `00:00:00` – `00:27:25`
- Major and minor numbers · Session 05 · S05-P1.mp4 · `00:27:25` – `00:35:23`
- dentry and inode · Session 05 · S05-P1.mp4 · `00:35:23` – `00:50:39`
- VFS · Session 12 · S12-P2.mp4 · `00:12:15` – `00:34:28`

### Virtual memory

- Process memory layout · Session 01 · S01-P1.mp4 · `00:27:47` – `00:34:19`
- Address space layout · Session 03 · S03-P1.mp4 · `00:00:00` – `00:24:43`
- Virtual address space · Session 10 · S10.mp4 · `00:13:58` – `00:28:41`
- Physical memory layout · Session 10 · S10.mp4 · `00:28:41` – `00:34:40`
- Pages and frames · Session 10 · S10.mp4 · `00:34:40` – `00:45:40`
- Page faults · Session 10 · S10.mp4 · `00:45:40` – `01:01:43`
- Memory zones · Session 10 · S10.mp4 · `01:01:43` – `01:15:27`
- Buddy and slab · Session 10 · S10.mp4 · `01:15:27` – `01:24:05`
- kmalloc and vmalloc · Session 10 · S10.mp4 · `01:24:05` – `01:46:19`

## Sessions

### Session 01

- `00:00:00` – `00:10:59` · S01-P1.mp4 — Course intro and syllabus
- `00:10:59` – `00:27:47` · S01-P1.mp4 — Compilation pipeline and ELF
- `00:27:47` – `00:34:19` · S01-P1.mp4 — Process memory layout
- `00:34:19` – `00:42:15` · S01-P1.mp4 — Section permissions and W^X
- `00:42:15` – `00:52:22` · S01-P1.mp4 — /proc filesystem
- `00:52:22` – `01:18:50` · S01-P1.mp4 — GDB
- `01:18:50` – `01:30:46` · S01-P1.mp4 — Endianness
- `00:00:00` – `00:09:45` · S01-P2.mp4 — GDB extensions
- `00:09:45` – `00:23:58` · S01-P2.mp4 — x86 registers and flags
- `00:23:58` – `00:38:58` · S01-P2.mp4 — Assembly instructions
- `00:38:58` – `01:18:16` · S01-P2.mp4 — 32-bit calling convention

### Session 02

- `00:00:00` – `00:27:23` · S02-P1.mp4 — Stack frames
- `00:27:23` – `00:36:54` · S02-P1.mp4 — Format string vulnerability
- `00:36:54` – `00:47:04` · S02-P1.mp4 — Compiler mitigations
- `00:47:04` – `01:04:35` · S02-P1.mp4 — PIE and ASLR
- `01:04:35` – `01:27:04` · S02-P1.mp4 — Out-of-bounds write
- `00:00:00` – `00:11:57` · S02-P2.mp4 — Stack buffer overflow
- `00:11:57` – `00:25:01` · S02-P2.mp4 — x64 calling convention
- `00:25:01` – `00:45:13` · S02-P2.mp4 — Linux kernel intro
- `00:45:13` – `00:56:35` · S02-P2.mp4 — Kernel source browsing
- `00:56:35` – `01:10:18` · S02-P2.mp4 — Kernel config and build
- `01:10:18` – `01:16:30` · S02-P2.mp4 — Booting custom kernel

### Session 03

- `00:00:00` – `00:24:43` · S03-P1.mp4 — Address space layout
- `00:24:43` – `01:05:42` · S03-P1.mp4 — Kernel config and build
- `01:05:42` – `01:17:44` · S03-P1.mp4 — QEMU virtio disk
- `01:17:44` – `01:25:35` · S03-P1.mp4 — Kernel GDB symbols
- `00:00:00` – `00:10:29` · S03-P2.mp4 — QEMU tap networking
- `00:10:29` – `00:19:14` · S03-P2.mp4 — strace and ltrace
- `00:19:14` – `00:42:45` · S03-P2.mp4 — File descriptors
- `00:42:45` – `00:49:26` · S03-P2.mp4 — Syscall ABI
- `00:49:26` – `01:06:55` · S03-P2.mp4 — Assembly syscalls

### Session 04

- `00:00:00` – `00:13:26` · S04-P1.mp4 — Syscall recap
- `00:13:26` – `00:32:03` · S04-P1.mp4 — stat syscalls
- `00:32:03` – `00:51:29` · S04-P1.mp4 — Syscall ABI
- `00:51:29` – `01:16:10` · S04-P1.mp4 — sys_call_table
- `01:16:10` – `01:25:27` · S04-P1.mp4 — vdso and vsyscall
- `00:00:00` – `00:09:10` · S04-P2.mp4 — Kernel modules
- `00:09:10` – `00:29:20` · S04-P2.mp4 — Hello kernel module
- `00:29:20` – `00:34:06` · S04-P2.mp4 — Loop device
- `00:34:06` – `00:46:02` · S04-P2.mp4 — EXPORT_SYMBOL

### Session 05

- `00:00:00` – `00:27:25` · S05-P1.mp4 — VFS
- `00:27:25` – `00:35:23` · S05-P1.mp4 — Major and minor numbers
- `00:35:23` – `00:50:39` · S05-P1.mp4 — dentry and inode
- `00:50:39` – `01:04:08` · S05-P1.mp4 — task_struct
- `01:04:08` – `01:22:46` · S05-P1.mp4 — fork and clone
- `00:00:00` – `00:11:28` · S05-P2.mp4 — Task linked list
- `00:11:28` – `00:26:52` · S05-P2.mp4 — procfs module
- `00:26:52` – `00:42:00` · S05-P2.mp4 — ftrace
- `00:42:00` – `01:01:12` · S05-P2.mp4 — function_graph
- `01:01:12` – `01:16:15` · S05-P2.mp4 — ftrace events

### Session 06

- `00:00:00` – `00:09:25` · S06-P1.mp4 — File integrity checks
- `00:09:25` – `00:16:51` · S06-P1.mp4 — VFS ftrace recap
- `00:16:51` – `00:42:46` · S06-P1.mp4 — ftrace hooks
- `00:42:46` – `00:53:18` · S06-P1.mp4 — Signal handling
- `00:53:18` – `01:01:13` · S06-P1.mp4 — Process states
- `01:01:13` – `01:20:00` · S06-P1.mp4 — Zombie processes
- `00:00:00` – `00:10:36` · S06-P2.mp4 — Task scheduling
- `00:10:36` – `00:18:17` · S06-P2.mp4 — Scheduling policies
- `00:18:17` – `00:47:45` · S06-P2.mp4 — task_struct priorities
- `00:47:45` – `00:57:19` · S06-P2.mp4 — IPC
- `00:57:19` – `01:11:54` · S06-P2.mp4 — POSIX shared memory

### Session 07

- `00:00:00` – `00:08:17` · S07-P1.mp4 — Per-CPU runqueues
- `00:08:17` – `00:12:34` · S07-P1.mp4 — Process sandboxing
- `00:12:34` – `00:41:08` · S07-P1.mp4 — seccomp
- `00:41:08` – `00:47:42` · S07-P1.mp4 — eBPF
- `00:47:42` – `00:57:18` · S07-P1.mp4 — bpftrace
- `00:57:18` – `01:16:50` · S07-P1.mp4 — systemd
- `00:00:00` – `00:08:31` · S07-P2.mp4 — PID 1 boot
- `00:08:31` – `01:05:24` · S07-P2.mp4 — Kernel threads
- `01:05:24` – `01:13:47` · S07-P2.mp4 — OOM killer

### Session 08

- `00:00:00` – `00:22:35` · S08-P1.mp4 — Digital forensics
- `00:22:35` – `00:32:07` · S08-P1.mp4 — Incident response
- `00:32:07` – `00:41:40` · S08-P1.mp4 — Live investigation
- `00:41:40` – `00:50:54` · S08-P1.mp4 — netcat transfer
- `00:50:54` – `01:18:57` · S08-P1.mp4 — Logger scripts
- `00:00:00` – `00:16:52` · S08-P2.mp4 — Sample log analysis
- `00:16:52` – `00:28:38` · S08-P2.mp4 — Live investigation
- `00:28:38` – `00:36:23` · S08-P2.mp4 — Memory acquisition
- `00:36:23` – `00:46:19` · S08-P2.mp4 — LiME
- `00:46:19` – `01:09:50` · S08-P2.mp4 — Volatility profiles

### Session 09

- `00:00:00` – `00:06:41` · S09-P1.mp4 — Live investigation
- `00:06:41` – `00:27:20` · S09-P1.mp4 — Volatility 3 ISF
- `00:27:20` – `00:38:57` · S09-P1.mp4 — Hidden kernel modules
- `00:38:57` – `00:46:59` · S09-P1.mp4 — bulk_extractor
- `00:46:59` – `01:01:08` · S09-P1.mp4 — Encrypted containers
- `01:01:08` – `01:11:34` · S09-P1.mp4 — sk_buff packets
- `01:11:34` – `01:18:00` · S09-P1.mp4 — User activity reconstruction
- `00:00:00` – `00:12:29` · S09-P2.mp4 — pslist and psenv
- `00:12:29` – `00:28:02` · S09-P2.mp4 — Bash history
- `00:28:02` – `00:43:46` · S09-P2.mp4 — Open files
- `00:43:46` – `00:53:35` · S09-P2.mp4 — Firefox history
- `00:53:35` – `00:58:34` · S09-P2.mp4 — USB mount timeline
- `00:58:34` – `01:03:51` · S09-P2.mp4 — TrueCrypt passphrase
- `01:03:51` – `01:07:25` · S09-P2.mp4 — setuid binary

### Session 10

- `00:00:00` – `00:13:58` · S10.mp4 — MemProcFS
- `00:13:58` – `00:28:41` · S10.mp4 — Virtual address space
- `00:28:41` – `00:34:40` · S10.mp4 — Physical memory layout
- `00:34:40` – `00:45:40` · S10.mp4 — Pages and frames
- `00:45:40` – `01:01:43` · S10.mp4 — Page faults
- `01:01:43` – `01:15:27` · S10.mp4 — Memory zones
- `01:15:27` – `01:24:05` · S10.mp4 — Buddy and slab
- `01:24:05` – `01:46:19` · S10.mp4 — kmalloc and vmalloc

### Session 11

- `00:00:00` – `00:13:45` · S11-P1.mp4 — ELF overview
- `00:13:45` – `00:26:54` · S11-P1.mp4 — ELF header
- `00:26:54` – `00:32:25` · S11-P1.mp4 — Entry point
- `00:32:25` – `00:49:57` · S11-P1.mp4 — Program headers
- `00:49:57` – `01:12:57` · S11-P1.mp4 — Segment types
- `01:12:57` – `01:21:26` · S11-P1.mp4 — Section headers
- `00:00:00` – `00:13:37` · S11-P2.mp4 — Section headers
- `00:13:37` – `00:26:53` · S11-P2.mp4 — Section types
- `00:26:53` – `00:32:41` · S11-P2.mp4 — Dynamic linking
- `00:32:41` – `00:51:41` · S11-P2.mp4 — PLT and GOT
- `00:51:41` – `01:12:30` · S11-P2.mp4 — Master boot record

### Session 12

- `00:00:00` – `00:15:23` · S12-P1.mp4 — MBR partition table
- `00:15:23` – `00:40:38` · S12-P1.mp4 — dd disk imaging
- `00:40:38` – `00:47:59` · S12-P1.mp4 — Mounting disk images
- `00:47:59` – `00:53:32` · S12-P1.mp4 — Extended partitions
- `00:53:32` – `01:11:51` · S12-P1.mp4 — UEFI Secure Boot
- `01:11:51` – `01:19:12` · S12-P1.mp4 — GPT partition layout
- `00:00:00` – `00:12:15` · S12-P2.mp4 — GPT partition parsing
- `00:12:15` – `00:34:28` · S12-P2.mp4 — VFS
- `00:34:28` – `00:39:00` · S12-P2.mp4 — Linux filesystem types
- `00:39:00` – `00:44:56` · S12-P2.mp4 — Journaling
- `00:44:56` – `00:51:28` · S12-P2.mp4 — Copy-on-write
- `00:51:28` – `01:03:15` · S12-P2.mp4 — ext filesystem blocks

### Session 13

- `00:00:00` – `00:12:15` · S13-P1.mp4 — ext4 on-disk layout
- `00:12:15` – `00:23:47` · S13-P1.mp4 — ext4 block groups
- `00:23:47` – `00:42:35` · S13-P1.mp4 — ext4 superblock
- `00:42:35` – `00:49:41` · S13-P1.mp4 — Inode number gaps
- `00:49:41` – `00:58:38` · S13-P1.mp4 — The Sleuth Kit
- `00:58:38` – `01:04:57` · S13-P1.mp4 — UAC collector
- `01:04:57` – `01:27:18` · S13-P1.mp4 — Apache honeypot case
- `00:00:00` – `00:07:41` · S13-P2.mp4 — icat file recovery
- `00:07:41` – `00:21:16` · S13-P2.mp4 — Process environment pivoting
- `00:21:16` – `00:43:17` · S13-P2.mp4 — Apache log analysis
- `00:43:17` – `00:48:47` · S13-P2.mp4 — Symbiote
- `00:48:47` – `00:56:13` · S13-P2.mp4 — BPFDoor
💬 Got any thoughts on this post?

I'd love to hear from you! Send me your feedback or comments via email.

reply by email