⚡ SpecInfo Runbook • Helpdesk & SysAdmin Tactical Series

Emergency Runbook: Windows Admin & Helpdesk

Field Incident Triage Procedures • NIST SP 800-88 & CIS Controls Baseline • Offline Ready

A4 Rack & Desk Laminate CODE: SEC-WIN-A4 • REV 2026.1

🖨️

1. Print Spooler Triage & RPC Error 0x0000011b

Emergency queue purge (delete locked .spl / .shd files): net stop spooler && del /Q /F /S "%systemroot%\System32\Spool\Printers\*.*" && net start spooler

Fix RPC Point & Print error 0x0000011b post security update:

reg add "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 0 /f && net stop spooler && net start spooler

Purge stalled print jobs for a specific printer only: Get-PrintJob -PrinterName "OfficePrinter" | Remove-PrintJob

Isolate printer driver in separate process (prevents spooler crash): Set-PrinterDriver -Name "Driver_Name" -Isolation Shared

Launch Print Server Properties (ports, drivers, forms dialog): printui.exe /s /t2

🔒

2. Active Directory, Lockouts & Trust Break

Check domain account lockout status & bad password timestamp: net user <username> /domain

Repair broken domain trust relationship on endpoint: Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Force machine password reset with domain controller: Reset-ComputerMachinePassword

Flush cached Kerberos tickets and re-request TGT: klist purge

Query endpoint local administrator password from LAPS: Get-LapsPassword -Identity $env:COMPUTERNAME

Force GPO re-application and output diagnostic HTML report: gpupdate /force && gpresult /h "$env:TEMP\gpreport.html"

🛡️

3. BitLocker Emergency CLI Recovery

Read 48-digit recovery key from CLI (record before reboot!): manage-bde -protectors -get C:

Suspend protection for 1 reboot (mandatory before BIOS/TPM flash): Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Unlock encrypted locked volume using recovery password: manage-bde -unlock D: -RecoveryPassword "XXXXXX-XXXXXX-..."

Force key backup escrow to Active Directory / Entra ID:

Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

Check BitLocker encryption status and protection method: manage-bde -status C:

⚠️

4. BSOD Triage, NVMe Health & Network Stack

5 most recent BlueScreen / WER system crash events from EventLog:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 5 | fl TimeCreated, Message

NVMe/SSD health telemetry (Wear %, I/O errors, temperature): Get-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk)[0] | fl Wear, ReadErrorsTotal, WriteErrorsTotal

Comprehensive component store repair and system file integrity check: DISM /Online /Cleanup-Image /RestoreHealth && sfc /scannow

Flush corrupt Windows Update cache and reset services: net stop wuauserv && net stop bits && rd /s /q %windir%\SoftwareDistribution && net start wuauserv

Hard reset Winsock, TCP/IP stack and flush DNS cache: netsh winsock reset && netsh int ip reset && ipconfig /flushdns

🌐 SpecInfo Rosetta Stone • Cross-Platform Network Matrix

Rosetta Network Runbook: Cisco • Linux • Windows

Top 10 RACK Incident Triage Commands • Cisco IOS CLI • Linux iproute2 • Windows PowerShell

A4 Rack & Desk Laminate CODE: SEC-NET-A4 • REV 2026.1

Triage Task	Cisco IOS CLI	Linux (iproute2 / CLI)	Windows PowerShell / CMD
1. IP Addresses & Link Status	show ip int brief	ip -br a	Get-NetIPAddress \| ft IPAddress, InterfaceAlias
2. Routing Table & Gateway	show ip route	ip r	Get-NetRoute -AddressFamily IPv4 \| ft
3. ARP & Dynamic MAC Table	show mac address-table dynamic	ip neigh	Get-NetNeighbor -AddressFamily IPv4 \| ft
4. Listening Ports & Sockets	show control-plane host open-ports	ss -tulpn	Get-NetTCPConnection -State Listen \| ft
5. MTU & Path Ping (DF Bit)	ping <IP> df-bit size 1500	ping -M do -s 1472 <IP>	Test-NetConnection -Port 443 <IP>
6. DNS Resolution & Target Query	ping domain.com	dig @1.1.1.1 domain.com +short	Resolve-DnsName domain.com -Server 1.1.1.1
7. VLAN Config (Access / Trunk)	switchport mode access; vlan 20	ip link add link eth0 name eth0.20 type vlan id 20	Set-NetAdapter -Name "vEth" -VlanID 20
8. Firewall Rules & Open Ports	show access-lists	ufw status numbered	Get-NetFirewallRule -Enabled True \| ft
9. Interface Errors (CRC / Drops)	show int \| inc (errors\|CRC\|drops)	ip -s link show eth0	Get-NetAdapterStatistics \| ft
10. Save Config / Service Restart	write memory	systemctl restart systemd-networkd	Restart-Service -Name "LanmanWorkstation"

⚡ SpecInfo Runbook • Cisco IOS & RACK Engineering Operations

Emergency Runbook: Cisco IOS Core & CLI

Configuration Procedures, Baseline Hardening & Network Triage • CIS Cisco Benchmark • Offline Mode

A4 Rack & Console Laminate CODE: SEC-CISCO-A4 • REV 2026.1

⌨️

1. CLI Modes & Navigation

Enter Privileged EXEC & Global Config: enable && configure terminal

Run EXEC command from config mode (magic `do`): do show ip interface brief

Instant jump back to Privileged EXEC (#): Ctrl+Z (or type: end)

Command line editing shortcuts: Ctrl+A (start) • Ctrl+E (end) • Ctrl+U (clear line)

⚙️

2. Baseline & Initial Hardening

Hostname & disable DNS lookup freeze on typo: hostname SW-CORE-01 && no ip domain-lookup

Sync console logs with typing & idle timeout: line con 0 && logging synchronous && exec-timeout 5 0

Legal warning banner (NIS2 / ISO 27001): banner motd #Authorized access only. All activity logged.#

Persist running configuration to NVRAM: copy running-config startup-config (or: write mem)

🔒

3. Access Security & SSHv2

Strong enable secret & global encryption: enable secret StrongPass123! && service password-encryption

Generate 2048-bit crypto keys & enforce SSHv2: ip domain-name specinfo.org && crypto key gen rsa mod 2048 && ip ssh ver 2

Enforce SSH on VTY lines (disable Telnet): line vty 0 15 && transport input ssh && login local

Console brute-force mitigation lock: login block-for 180 attempts 3 within 60

💾

4. IOS Upgrade & MD5 Verification

Inspect free flash storage space: dir flash:

Copy binary image from TFTP or USB flash: copy tftp://192.168.1.50/c2960x.bin flash: (or usbflash0:)

Verify MD5 hash against Cisco release before reload: verify /md5 flash:c2960x.bin 8b7d6a5f9c...

Point bootloader to image, save and reload: boot system flash:c2960x.bin && write mem && reload

📡

5. IGMP Snooping & Multicast

Global IGMP Snooping (prevent IPTV flooding): ip igmp snooping

Enable snooping & local Querier in specific VLAN: ip igmp snooping vlan 10 && ip igmp snooping vlan 10 querier

Inspect active multicast groups & ports: show ip igmp snooping groups

Verify active IGMP Querier status in subnet: show ip igmp snooping querier vlan 10

🌐

6. BGP Routing Cheat Sheet (Edge / ISP)

Initialize BGP process with autonomous system (ASN): router bgp 65001

Configure upstream eBGP ISP peer & MD5 key: neighbor 198.51.100.1 remote-as 64512 && neighbor 198.51.100.1 password BGPKey

Advertise public IP network block to internet: network 203.0.113.0 mask 255.255.255.0

Triage session status & soft-reset inbound routes: show ip bgp summary && clear ip bgp 198.51.100.1 soft in

⚡ SpecInfo Runbook • SRE & SysAdmin Tactical Series

Emergency Runbook: Linux Server & DevOps Triage

Field Incident Triage Procedures • Service Crashes, OOM, 100% Disk, LVM, Network • Offline Ready

A4 Rack & Terminal Laminate CODE: SEC-LINUX-A4 • REV 2026.1

⚙️

1. Systemd & Crashed Services (Failed Units)

Instant audit of degraded units and failed services: systemctl --failed --all

Service crash trace without pager lock or line truncation: journalctl -xeu <service> -n 50 --no-pager

Reload modified unit definitions & restart daemon: systemctl daemon-reload && systemctl restart <service>

Inspect core dump post process segfault / crash: coredumpctl list && coredumpctl info <PID>

🧠

2. OOM-Killer, RAM & Buffer Cache Triage

Verify process killed by kernel (Out Of Memory invocation): dmesg -T | grep -i -E 'killed process|oom-killer'

Top 10 processes consuming physical RAM: ps aux --sort=-%mem | head -n 11

Safe flush of dirty pages & drop clean caches/buffers: sync && echo 3 > /proc/sys/vm/drop_caches

Inspect swap usage and kernel memory thrashing (si/so > 0): swapon --show && vmstat 1 5

💾

3. 100% Disk Full & Ghost Files (L1 Triage)

Locate giant files on current filesystem partition: find /var /tmp -xdev -type f -size +200M -exec ls -lh {} +

Files deleted (rm) but locked by running process (ghost disk): lsof +L1 (kill PID or truncate: > /proc/<PID>/fd/<FD>)

Release 4% of 5% reserved root blocks to restore SSH login: tune2fs -m 1 /dev/sdX1

Emergency vacuum of oversized systemd journal logs: journalctl --vacuum-size=200M

💽

4. Zero-Downtime LVM Storage Extension

Rescan expanded virtual SCSI disk without rebooting: echo 1 > /sys/class/block/sda/device/rescan

Update LVM Physical Volume (PV) to new physical capacity: pvresize /dev/sda3 (or /dev/sda)

Extend Logical Volume and filesystem (ext4/xfs) in one command: lvextend -r -l +100%FREE /dev/mapper/vg0-root

Verify block topology, mount points and free space: lsblk -f && df -hT /

🌐

5. Network, Open Ports & Traffic Inspection

Identify process listening on specific TCP/UDP port with PID: ss -tulpn | grep :<port>

Interface packet drop, CRC checksum errors & link stats: ip -s link show dev eth0

Live packet capture triage (e.g. check HTTPS handshake): tcpdump -nn -c 20 -i any port 443

Flush systemd-resolved DNS client cache immediately: resolvectl flush-caches

💀

6. Zombie Processes & SysRq Recovery

Locate defunct Zombie processes and identify parent (PPID): ps -eo stat,ppid,pid,comm | grep -w '^Z'

Validate sshd_config syntax BEFORE restarting SSH daemon: sshd -t (prevents lockout from production host)

Graceful reload or hard kill of unresponsive process: kill -HUP <PID> (or immediate force: kill -9 <PID>)

Emergency clean reboot of frozen kernel (Magic SysRq): echo 1 > /proc/sys/kernel/sysrq && echo b > /proc/sysrq-trigger

⚡ SpecInfo Runbook • IT Support & Helpdesk Operations Series

Emergency Runbook: IT Support Tier 1 & 2 Quick-Fixes

Frontline Triage Procedures for Mass User Issues • Active Directory, Outlook, Teams, Audio, Wi-Fi, LAPS • Offline Mode

A4 Desk & Field Laminate CODE: SEC-DESK-A4 • REV 2026.1

🔐

1. Authentication & Lockouts (AD & Logins)

Unlock domain account directly without AD Users & Computers GUI: net user <login> /active:yes /domain

Instant verification of account lockout status and bad password time: net user <login> /domain | findstr /i "locked"

Identify lockout loop source (Event ID 4740 on DC): Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -MaxEvents 5 | Format-List

Inspect and flush stale credentials from Credential Manager: cmdkey /list (delete: cmdkey /delete:target)

👤

2. Corrupted Profiles & TEMP Triage

Detect and fix TEMP profile (remove .bak key in ProfileList): reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s | findstr /i "\.bak"

Repair corrupted permissions on user profile folder (icacls): icacls "C:\Users\<user>" /reset /t /c /l /q

Take ownership of locked user folder after profile rebuild: takeown /F "C:\Users\<user>" /R /D Y

Hard restart frozen Windows Desktop shell and taskbar: taskkill /f /im explorer.exe && start explorer.exe

🖥️

3. Audio, Video & Peripheral Devices

Hard restart GPU drivers (unfreeze black/frozen display): Win + Ctrl + Shift + B (hardware hotkey)

Restart Windows Audio service (muted sound in Teams/Zoom/mic): net stop audiosrv && net start audiosrv

Force system re-scan for newly connected PnP devices: pnputil /scan-devices

Restart frozen or hanging USB device controller: pnputil /restart-device "USB\VID_..."

📧

4. Productivity Apps: M365, Outlook & Teams

Launch Microsoft Outlook in emergency Safe Mode (no add-ins): outlook.exe /safe

Reset corrupted navigation pane and custom folder views: outlook.exe /resetnavpane && outlook.exe /cleanviews

Hard flush New Teams cache (MSTeams AppData package cache): taskkill /f /im ms-teams.exe && rmdir /s /q "%localappdata%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache"

Repair hanging Windows Installer service registration: msiexec /unregister && msiexec /regserver

📶

5. Network, Wi-Fi & Print Spooler

Flush DNS cache, release, and renew IP lease from DHCP: ipconfig /flushdns && ipconfig /release && ipconfig /renew

Delete corrupted or outdated saved Wi-Fi network profile: netsh wlan delete profile name="NetworkName"

Display saved Wi-Fi password in plain text: netsh wlan show profile name="NetworkName" key=clear

Instant hard flush of frozen Print Spooler queue: net stop spooler && del /q /f "%systemroot%\System32\Spool\Printers\*.*" && net start spooler

🔋

6. Hardware Health, Battery & Field Diagnostics

Generate comprehensive battery health and degradation report: powercfg /batteryreport /output "C:\battery.html"

Instant SMART health audit for NVMe / SSD drives: wmic diskdrive get model,status,size

Verify and automatically repair broken domain trust relationship: Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Retrieve Local Administrator Password Solution (LAPS) secret: Get-LapsPassword -Identity $env:COMPUTERNAME

🚨 SpecInfo Runbook • Security & Crisis Management Series

Emergency Runbook: Ransomware & Incident Response NIS2

Golden Hour Triage • Never Power Off Rule • RAM Memory Dump • CSIRT Deadlines (24h/72h/1M) • Chain of Custody

A4 SOC & Executive Desk CODE: SEC-INC-A4 • REV 2026.1

🛑

1. Golden 15 Min — Never Power Off!

CRITICAL RULE (Preserve RAM encryption keys & volatile data): DO NOT POWER OFF OR REBOOT INFECTED HOSTS!

Physical network isolation: disconnect LAN RJ45 & Wi-Fi immediately: Physical LAN cable OUT • Wi-Fi Switch OFF / Airplane Mode

Disable network adapter via CLI (if physical access is unavailable): netsh interface set interface "Ethernet" disable (Linux: ip link set eth0 down)

Backup media isolation: NEVER plug USB/backup drives into infected workstations!

💾

2. Volatile RAM & Artifact Preservation

Dump active network connections with PID (C2 beacon detection): netstat -ano | findstr /i "established syn_sent" > C:\evidence_net.txt

Export running processes with complete command lines: wmic process get ProcessId,CommandLine /format:csv > C:\evidence_proc.csv

Dump volatile memory of suspicious process (ProcDump): procdump.exe -ma <PID> C:\evidence_dump.dmp

Dump open network file handles (SMB file shares): openfiles /query /fo csv > C:\evidence_files.csv

⚠️

3. Ransomware Indicators of Compromise (IoC)

Detect shadow copy wipe attempts (Volume Shadow Copies): vssadmin list shadows (attack: vssadmin delete shadows /all /quiet)

Detect recovery sabotage in Windows bootloader configuration: bcdedit /enum {default} | findstr /i "safeboot ignoreallfailures"

Detect mass event log wiping (Security Log Clear): wevtutil cl Security (hunt for Event ID 1102: Audit Log Cleared)

Inspect unusual scheduled tasks for persistence: schtasks /query /fo TABLE /nh | findstr /i /v "Microsoft"

🛡️

4. AD & Privileged Account Isolation

Immediately disable compromised administrator account: Disable-ADAccount -Identity "<admin_user>"

Double KRBTGT password reset (invalidate Golden Ticket forging): Reset-KrbTgtPassword.ps1 -Mode TwoReset (or 2x with replication window)

Terminate active RDP sessions across Domain Controllers: quser && logoff <SessionID>

Block lateral movement ports on firewall (SMB 445 & RDP 3389): New-NetFirewallRule -DisplayName "DROP_SMB" -Action Block -LocalPort 445 -Protocol TCP

⏱️

5. NIS2 & DORA Reporting Deadlines (CSIRT)

24h — Early Warning Notification (to national CSIRT): Suspected attack, incident scope, cross-border impact potential

72h — Formal Incident Notification: Initial severity assessment, Indicators of Compromise (IoC), mitigations

1 Month — Final Incident Report: Root cause analysis, business disruption impact, ISMS audit corrections

Executive Management Liability (NIS2 Art. 20): Fines up to €10M / 2% turnover + temporary suspension of management duties

📜

6. Cyber Insurance & Chain of Custody

First-hour policy rule: call insurance crisis hotline BEFORE vendor hiring: Call Policy Emergency Hotline (mandatory for DFIR reimbursement)

Cryptographic proof of evidence integrity (Chain of Custody): certutil -hashfile C:\evidence_dump.dmp SHA256 (Linux: sha256sum)

Incident timeline log (Operational War Room Journal): Record: Timestamp (minute), Actor, Command Executed, Target, Result

Threat actor contact policy: NEVER negotiate ransom without insurer broker & law enforcement approval!

🐧 SpecInfo Runbook • Multi-OS & Enterprise Engineering Series

Emergency Runbook: Linux Workstation & Hybrid SysAdmin

Managing Windows/AD Infrastructure from Linux CLI • RDP, Kerberos, SMB, 802.1X, PipeWire, SSH SOCKS

A4 Terminal & Jump-Host CODE: SEC-HYBRID-A4 • REV 2026.1

🖥️

1. Remote Desktop & Windows (RDP & WinRM)

FreeRDP session with multi-monitor and smart dynamic resolution: xfreerdp /v:<ip> /u:<user> /d:<domain> /multimon /dynamic-resolution /clipboard +auto-reconnect

Remote PowerShell Core session from Linux to Windows (WinRM): pwsh -Command "Enter-PSSession -ComputerName <ip> -Credential <user> -Authentication Negotiate"

Active Directory administration from Linux via PowerShell Core: pwsh -Command "Import-Module ActiveDirectory; Get-ADUser -Identity <login> -Properties *"

Fast port availability probe for RDP (3389) and WinRM (5985): nc -zv -w3 <ip> 3389 5985

📂

2. Active Directory, Kerberos & SMB

Acquire and verify Kerberos ticket granting ticket (TGT): kinit <user>@DOMAIN.CORP && klist

Explore Windows SMB file shares without mounting (CLI): smbclient -L //<server_ip> -U <user>%<password> -W <domain>

Mount enterprise CIFS share using active Kerberos credentials: mount -t cifs //<server>/share /mnt/ad -o sec=krb5,cruid=$(id -u)

Query Active Directory via LDAP directly from Linux terminal: ldapsearch -H ldap://dc1.domain.corp -b "dc=domain,dc=corp" "(sAMAccountName=<user>)"

📶

3. Enterprise Wi-Fi 802.1X & VPN (CLI)

Configure corporate Enterprise Wi-Fi (PEAP / MSCHAPv2):

nmcli con add type wifi con-name "CorpNet" ifname wlan0 ssid "CorpNet" wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity "<user>"

Connect and disconnect corporate VPN profile via CLI: nmcli con up "Corp-WireGuard" && nmcli con down "Corp-WireGuard"

Verify DNS leak prevention by forcing queries on VPN interface: resolvectl query --interface=wg0 internal.corp

Inspect routing table for dual-gateway routing conflicts: ip route show table all | grep default

🔊

4. Audio & Desktop: PipeWire & Wayland

Instant restart of PipeWire audio stack without session logout: systemctl --user restart pipewire pipewire-pulse wireplumber

Switch Bluetooth headset profile from A2DP to HSP/HFP (microphone): wpctl status && wpctl set-profile <node_id> <profile_id>

Verify current display server session type (Wayland or X11): echo $XDG_SESSION_TYPE

Soft restart frozen desktop compositor (GNOME Shell on X11): killall -HUP gnome-shell (Wayland: switch to TTY Ctrl+Alt+F3)

🔑

5. SSH Bastion, SOCKS Proxy & Jump Host

Dynamic SOCKS5 proxy via bastion (browse intranet in browser): ssh -D 1080 -f -C -q -N <bastion_user>@<bastion_ip>

Forward database port through intermediary jump host: ssh -J <bastion> -L 5432:db-internal.corp:5432 <db_user>@db-internal.corp

Install public SSH key on new remote host without typing password: ssh-copy-id -i ~/.ssh/id_ed25519.pub <user>@<target_ip>

Prevent aggressive firewall disconnections on idle SSH sessions: ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 <host>

🐳

6. Containers & DevOps Micro-Triage (Docker)

Complete cleanup of dangling containers, networks, and volumes: docker system prune -af --volumes

Real-time CPU and RAM telemetry stream for all running containers: docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"

Inspect running processes inside container without executing a shell: docker top <container_id>

Instant tail of container logs for the last 15 minutes: docker logs --since 15m -t <container_name>

📶 SpecInfo Runbook • Network Security & SMB / ISP Series

Emergency Runbook: MikroTik RouterOS v7 & Fortinet FortiOS

Edge & Firewall Triage Procedures • Safe Mode, RoMON, Conntrack, Conserve Mode, Crashlog, IPsec

A4 Edge & Firewall Laminate CODE: SEC-ROUTER-A4 • REV 2026.1

🛡️

1. MikroTik: Safe Mode & Recovery

Enable emergency Safe Mode (auto-rollback upon disconnect): Ctrl + X (console displays <SAFE> prompt indicator)

Export clean configuration without secrets or default values: /export file=rescue_cfg compact hide-sensitive

Emergency L2 management access without IP (enable RoMON): /romon set enabled=yes secrets="RescuePass2026"

Hard factory reset without default script (clean slate start): /system reset-configuration no-defaults=yes skip-backup=yes

🔥

2. MikroTik: Firewall & Conntrack Triage

Inspect and flush exhausted connection tracking table (DDoS): /ip firewall connection print count-only (flush: .. remove [find])

Instant blackhole drop of brute-force attacks on SSH/Winbox: /ip firewall filter add chain=input protocol=tcp dst-port=22,8291 connection-state=new action=drop comment="DROP_BRUTE"

Identify suspicious hosts generating millions of stale sessions: /ip firewall connection print where timeout>1d

Temporarily disable problematic firewall drop rule: /ip firewall filter disable [find comment="DROP_BRUTE"]

🔦

3. MikroTik: Torch, Port Monitor & PCAP

Real-time traffic inspection broken down by IP and ports (Torch): /tool torch interface=ether1 port=any protocol=any

Monitor physical port link state, duplex, and speed negotiation: /interface ethernet monitor ether1 once

On-the-fly bandwidth throughput test to another RouterOS peer: /tool bandwidth-test address=10.0.0.1 user=admin direction=both

Capture live packets into PCAP file for Wireshark inspection: /tool sniffer start file-name=dump.pcap && /tool sniffer stop

🧠

4. Fortinet: Conserve Mode Triage (RAM)

Verify system memory distress status (Conserve Mode status): diagnose hardware sysinfo conserve

Top physical RAM consuming processes (wad proxy, ipsengine): diagnose sys top 2 20 (sort: q quit, p by memory)

Soft restart WAD proxy workers and IPS engine without reboot: diagnose test application wad 99 && diagnose test app ipsmonitor 99

Emergency purge of session buffers and FortiGate cache: execute log delete-all (and: diagnose sys session clear)

🔍

5. Fortinet: Sessions, Crashlog & Flow

Inspect kernel crashlog and process crash reasons (post-reboot): diagnose debug crashlog read

Apply targeted session inspection filter for specific IP/port: diagnose sys session filter dport 443 && diagnose sys session filter dst 10.0.0.1

List filtered active firewall sessions in real time: diagnose sys session list

Live packet trace through FortiOS firewall engine (Flow Trace): diagnose debug flow filter addr 10.0.0.1 && diagnose debug flow show console enable && diagnose debug enable

🌐

6. Fortinet: IPsec VPN & IKE Triage

Verify IKE gateways and Phase 1 IPsec tunnel status: diagnose vpn ike gateway list

Inspect Phase 2 IPsec encryption state and active bytes: diagnose vpn tunnel list

Force restart hung IPsec VPN tunnel without rebooting gateway: diagnose vpn ike restart && diagnose vpn tunnel reset <tunnel_name>

Live debug trace for IKE key negotiations (diagnose PSK errors): diagnose debug application ike -1 && diagnose debug enable

🐧 SpecInfo Disaster Recovery • Emergency Rescue Shell & Kernel Rebuild

Linux Boot & Disaster Recovery: GRUB2 • Chroot • Initramfs

Broken Boot Emergency Triage • LiveCD Chroot Gold Standard • EFI/MBR Repair & Emergency Fstab Recovery

A4 Rack & Desk Laminate CODE: SEC-BOOT-A4 • REV 2026.1

🛠️

1. LiveCD / USB Chroot Gold Standard

Inspect disk partitions and mount rootfs & EFI: lsblk -f && mount /dev/nvme0n1p2 /mnt && mount /dev/nvme0n1p1 /mnt/boot/efi

Bind pseudo-filesystems & DNS networking (resolv.conf):

for d in dev dev/pts proc sys tmp; do mount --bind /$d /mnt/$d; done && mount -o bind /etc/resolv.conf /mnt/etc/resolv.conf

Enter the target chroot environment in Bash shell: chroot /mnt /bin/bash

Clean environment exit & safe cascading unmount: exit && sync && (umount -R /mnt || umount /mnt/{proc,sys,dev/pts,dev,tmp}) && reboot

💿

2. GRUB2 Reinstall (UEFI vs BIOS MBR)

UEFI install (--removable flag prevents lost NVRAM entries): grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --recheck --removable

Legacy BIOS / MBR install directly to physical drive: grub-install --target=i386-pc /dev/nvme0n1 --recheck

Generate fresh grub.cfg configuration file: Debian/Ubuntu: update-grub | Arch/RHEL: grub-mkconfig -o /boot/grub/grub.cfg

Inspect & force motherboad NVRAM boot order: efibootmgr -v && efibootmgr -o 0001,0000,0002

📦

3. Initramfs & Package Repair

Debian/Ubuntu (repair interrupted dpkg & rebuild initramfs): dpkg --configure -a && apt --fix-broken install && update-initramfs -u -k all

Arch Linux (populate pacman keyrings & compile mkinitcpio): pacman-key --init && pacman-key --populate archlinux && mkinitcpio -P

RHEL / Rocky / Alma Linux (forced Dracut rebuild): dracut --regenerate-all --force && lsinitrd /boot/initramfs-$(uname -r).img | head -n 5

Verify ramdisk contains critical NVMe, LVM & ext4 drivers: lsinitramfs /boot/initrd.img-$(uname -r) | grep -E "nvme|dm-mod|ext4"

🔑

4. Reset Root Password & Rescue Accounts

RHEL/CentOS/Rocky (in GRUB menu 'e', append to linux: rd.break): mount -o remount,rw /sysroot && chroot /sysroot && passwd root && touch /.autorelabel

Debian/Ubuntu (in GRUB menu 'e', replace ro with: rw init=/bin/bash): mount -n -o remount,rw / && passwd root && exec /sbin/init

Emergency create admin with sudo/wheel permissions in chroot: useradd -m admin && passwd admin && usermod -aG sudo,wheel,audio,video admin

Reset brute-force lockout on locked accounts (PAM faillock): faillock --user root --reset && faillock --user admin --reset

🚨

5. Emergency Mode & Broken /etc/fstab

Emergency mode: remount rootfs and detect Windows NTFS partitions: mount -o remount,rw / && lsblk -f | grep -i ntfs

Step 1: Dry-run test without modifications (safe metadata analysis): sudo ntfsfix --no-action /dev/sda4 (or: /dev/nvme0n1p4)

Step 2: Reset dirty flag & clear Windows Fast Startup lock: sudo ntfsfix --clear-dirty /dev/sda4

Guard secondary mounts against boot hanging (entry in /etc/fstab): In fstab append: defaults,nofail,x-systemd.device-timeout=5 0 2

Reload systemd daemon & resume normal boot sequence: systemctl daemon-reload && systemctl default

🖥️

6. grub rescue> Console Recovery (No Menu)

Detect visible drives and partitions in rescue prompt: ls

Locate partition containing GRUB bootloader modules: ls (hd0,gpt2)/boot/grub (or: ls (hd0,gpt1)/grub)

Set root prefix, load normal module & restore graphical menu: set root=(hd0,gpt2) && set prefix=(hd0,gpt2)/boot/grub && insmod normal && normal

Manually boot kernel directly from grub> rescue prompt: linux (hd0,gpt2)/vmlinuz root=/dev/nvme0n1p2 ro && initrd (hd0,gpt2)/initrd.img && boot

🍏 SpecInfo Apple Engineering • macOS Admin & Power-User Triage Series

Apple macOS Admin: Recovery • APFS • CLI Triage

Apple Silicon & Intel Service Procedures • Admin Password Reset • APFS Repair & Hardware Triage

A4 Service & Desk Laminate CODE: SEC-MAC-A4 • REV 2026.1

🔑

1. Password Recovery & .AppleSetupDone

Official GUI password reset assistant in Recovery Terminal: resetpassword (Apple Silicon: hold Power ➔ Options; Intel: Cmd+R)

Golden trick: delete setup marker (creates fresh admin account): rm "/Volumes/Macintosh HD - Data/var/db/.AppleSetupDone" && reboot

Verify FileVault volume encryption status from CLI: fdesetup status

Regenerate new personal FileVault recovery key escrow: sudo fdesetup changerecovery -personal

🔄

2. macOS Updates & Apple CDN Installers

Install all pending system updates & patches in background: sudo softwareupdate -ia --verbose

List all full macOS installers available on Apple CDN: softwareupdate --list-full-installers

Fetch full official installer .app directly to /Applications/: softwareupdate --fetch-full-installer --full-installer-version 15.3

Create bootable USB installation flash drive (Zero-Click): sudo /Applications/Install\ macOS\ *.app/Contents/Resources/createinstallmedia --volume /Volumes/MyUSB --nointeraction

🛠️

3. Recovery & DFU Mode (Apple Silicon / Intel)

Intel Recovery: local, latest compatible, and factory original: Cmd+R (local) | Opt+Cmd+R (latest macOS) | Shift+Opt+Cmd+R (factory)

Apple Silicon 2TR Fallback Recovery (when 1TR fails to boot): Rapid double-tap & long hold of the Power button

Revive bricked Mac with black screen via DFU & USB-C cable: Connect to second Mac ➔ Apple Configurator ➔ Menu: Revive Device

Select default boot startup disk from Terminal console: sudo systemsetup -setstartupdisk /Volumes/Macintosh\ HD

💽

4. APFS Formatting & Volumes (diskutil)

Inspect APFS container structure (System, Data, Preboot): diskutil list && diskutil apfs list

Safely delete user data volume group before clean installation: diskutil apfs deleteVolume "Macintosh HD - Data"

Full physical drive format to APFS with GPT partition table: diskutil eraseDisk APFS "Macintosh HD" /dev/disk0

Reclaim disk space from hidden Time Machine local snapshots: tmutil listlocalsnapshots / && tmutil deletelocalsnapshots <snapshot_id>

🛑

5. Audio, Bluetooth & Gatekeeper Triage

Restart CoreAudio (restore lost sound after dock disconnect): sudo killall coreaudiod

Hard restart Bluetooth daemon without rebooting system: sudo pkill bluetoothd

Remove Gatekeeper quarantine flag (App is damaged error): sudo xattr -r -d com.apple.quarantine /Applications/App.app

Reset broken TCC privacy permissions (camera/mic/screen in Teams): tccutil reset All com.microsoft.teams

🧠

6. Apple Silicon, Rosetta 2 & Battery

Verify binary architecture (arm64 vs x86) & run x86 zsh shell: file $(which node) && arch -x86_64 /bin/zsh

Silent installation of Rosetta 2 translator with license accepted: softwareupdate --install-rosetta --agree-to-license

Find processes preventing sleep & draining battery in bag: pmset -g assertions | grep -E "PreventUserIdleSystemSleep|NoDisplaySleepAssertion"

Properly flush DNS cache in macOS Sonoma & Sequoia: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

🖥️ SpecInfo Hypervisor Engineering • Virtualization & Cluster Disaster Recovery Series

Virtualization & Clusters Rescue: Proxmox VE • VMware ESXi

Emergency CLI Corosync Quorum Recovery • Machine Lock Removal • Storage Triage ZFS & LVM-Thin

A4 Rack & Desk Laminate CODE: SEC-VIRT-A4 • REV 2026.1

🛡️

1. Proxmox VE: Cluster, Quorum & Locks

Emergency quorum override after node loss (enables VM startup): pvecm expected 1

Remove hung backup/snapshot lock preventing VM or LXC startup: qm unlock <vmid> && pct unlock <vmid>

Verify Corosync cluster communication rings and node votes: pvecm status && corosync-cfgtool -s

Restart cluster management daemons without killing running VMs: systemctl restart pve-cluster corosync pvedaemon pveproxy

Force pmxcfs database into local standalone mode (when isolated): systemctl stop pve-cluster && pmxcfs -l && systemctl start pve-cluster

💾

2. Proxmox VE: Storage Rescue (ZFS & LVM)

Diagnose degraded ZFS pool and replace failed drive on the fly: zpool status -x && zpool replace <pool> <old_guid> /dev/disk/by-id/<new_disk>

Rescue from I/O freeze when LVM-Thin data pool hits 100% capacity: lvextend -L +20G /dev/pve/data && pvesm status

List and force-purge orphaned snapshots eating up storage pool space: qm listsnapshot <vmid> && qm delsnapshot <vmid> snap-temp --force 1

Forced lazy unmount of frozen NFS or SMB share blocking storage service: umount -f -l /mnt/pve/<storage_name>

Initiate background scrub of ZFS storage pool to repair data checksums: zpool scrub <pool> && zpool status <pool>

⚡

3. Proxmox VE: VM & LXC CLI Triage

Hard kill frozen QEMU hypervisor process immediately: qm stop <vmid> --skiplock 1 || kill -9 $(cat /run/qemu-server/<vmid>.pid)

Enter root rescue shell into an unbootable or broken LXC container: pct enter <vmid> || pct console <vmid>

Direct inspection and repair of raw VM hardware configuration file: nano /etc/pve/qemu-server/<vmid>.conf

Set emergency boot order to rescue ISO from command line and start: qm set <vmid> --boot order=ide2;scsi0 && qm start <vmid>

Hot-resize virtual disk on the fly without shutting down guest OS: qm disk resize <vmid> scsi0 +20G

🩺

4. VMware ESXi: Emergency CLI Triage

List all running virtual machines with their respective World IDs: esxcli vm process list

Force kill an unresponsive or locked VM process using its World ID: esxcli vm process kill --type=force --world-id=<vmid>

Restart host management agents hostd & vpxa without impacting VMs: /etc/init.d/hostd restart && /etc/init.d/vpxa restart

Restart all ESXi management services from SSH console / DCUI: services.sh restart

Check locked VMDK virtual disk and discover lock holder MAC address: vmkfstools -D /vmfs/volumes/<storage_name>/<vm_name>/<vm_name>.vmdk

🌐

5. VMware ESXi: vSwitch & Kernel Logs

Inspect physical NIC adapter status (Link, Speed, Duplex negotiation): esxcli network nic list

List standard virtual switches, active portgroups, and VLAN mappings: esxcli network vswitch standard list

Rescan all storage adapters (iSCSI, Fibre Channel, SAS HBAs): esxcli storage core adapter rescan --all

Tail live VMkernel logs in real time (triage SCSI aborts and PSOD causes): tail -f /var/log/vmkernel.log | grep -iE "error|warn|scsi|alert"

Generate full diagnostic vm-support bundle directly to datastore: vm-support -f /vmfs/volumes/<storage_name>/esxi-support-bundle.tgz

🔄

6. V2V Migrations & Disaster Recovery

Convert VMware VMDK disk to Proxmox QCOW2 with progress bar: qemu-img convert -p -f vmdk -O qcow2 source.vmdk dest.qcow2

Import virtual disk directly into Proxmox target VM storage: qm importdisk <vmid> dest.qcow2 local-lvm --format qcow2

Backup ESXi host firmware configuration bundle to tgz archive: vim-cmd hostsvc/firmware/backup_config

Emergency backup of entire Proxmox cluster state (/etc/pve): tar -czvf /root/pve-cluster-backup-$(date +%F).tar.gz /etc/pve /etc/network/interfaces

Re-create missing VM from raw existing LVM / ZFS disk volume: qm create <vmid> --scsi0 local-zfs:vm-<vmid>-disk-0 --boot order=scsi0

🔒 SpecInfo Cyber Security & Compliance • ITAD, NIST SP 800-88 & GDPR Art. 32 Series

ITAD & NIST SP 800-88: Data Sanitization & Disposal

Sanitization Decision Matrix Clear • Purge • Destroy • Hardware Crypto Erase NVMe & SATA • Audit Proof

A4 Audit & Lab Laminate CODE: SEC-ITAD-A4 • REV 2026.1

⚖️

1. NIST SP 800-88 R1: Sanitization Matrix

CLEAR (Logical): Overwrites data (ATA Erase, dd, shred). Vulnerable to lab tools. Scope: Internal redeployment within same trust boundary

PURGE (Crypto / Block Erase): Renders recovery impossible in forensic labs. Scope: External device retirement, resale or hardware lease return

DESTROY (Physical): Shredding (<2mm SSD), degaussing for HDD, incineration. Scope: Failed drives with top-secret data or incompatible media

Compliance Mandate: GDPR Art. 32 & ISO/IEC 27001 Annex A.8.10: Written Certificate of Destruction containing verified drive serial number

⚡

2. NVMe & SSD: Hardware Crypto Erase

Instant hardware Crypto Scramble on NVMe drive (1 second, destroys internal AES key): nvme format /dev/nvme0n1 --namespace-id=1 --ses=2

Verify native controller support for NVMe Sanitize capabilities: nvme id-ctrl /dev/nvme0 -H | grep -i sanitize

Hardware Block Erase across all NAND flash cells (NIST Purge compliance): nvme sanitize /dev/nvme0 -a 2

Inspect live hardware progress and completion status of Sanitize operation: nvme sanitize-log /dev/nvme0

Trigger controller-level Cryptographic Erase sanitize action: nvme sanitize /dev/nvme0 -a 4

💽

3. SATA HDD/SSD: ATA Secure Erase

Check drive ATA security lock status (verify if BIOS marked it "frozen"): hdparm -I /dev/sda | grep -iE "frozen|locked|supported"

Bypass "frozen" lock by instant SATA bus sleep (S3 Sleep) or power hot-plug: echo mem > /sys/power/state (or briefly unplug and reconnect SATA power cable)

Step 1: Set temporary ATA user security password (standard requirement): hdparm --user-master u --security-set-pass SpecPass123 /dev/sda

Step 2: Execute native hardware ATA Enhanced Secure Erase (or standard erase): hdparm --user-master u --security-erase-enhanced SpecPass123 /dev/sda

Confirm password lock is automatically removed after sanitization finishes: hdparm -I /dev/sda | grep -i "not locked"

🧹

4. Multi-Pass Overwrite (Linux CLI)

Fast single-pass zero-fill with live real-time speed progress indicator: dd if=/dev/zero of=/dev/sda bs=4M status=progress conv=fdatasync

Standard 3-pass cryptographic pseudorandom wipe followed by zeroing: shred -v -n 3 -z /dev/sda

Certified military sanitization using scrub utility (US DoD 5220.22-M standard): scrub -p dod /dev/sda

Verify that the first 10 MB and last 10 MB contain strictly null bytes (00): hexdump -C -n 10485760 /dev/sda | head -n 5

Completely wipe all partition table headers and filesystem superblocks: wipefs -a /dev/sda

📱

5. Apple Mac, Mobile Fleet & MDM

Apple Silicon Mac: Erase all contents & settings cleanly from CLI without prompt: sudo eraseinstall --erase --confirm-reinstall --os 15.3

Verify device has been cleanly unenrolled from corporate MDM / Apple Business Manager: sudo profiles show -type enrollment

Wipe hardware encryption keys in Secure Enclave / T2 chip via DFU Mode: Apple Configurator 2 ➔ Restore Device (destroys hardware FileVault keys)

Android Enterprise ITAD: Hard factory reset and cache erase via Fastboot: adb reboot recovery && fastboot erase userdata && fastboot erase cache

Remove OEM / FRP (Factory Reset Protection) lock prior to asset disposal: fastboot oem unlock || fastboot flashing unlock

📜

6. ITAD Audit Proof & SHA-256 Hash

Extract complete hardware drive identity (Model, Serial Number, User Capacity): smartctl -i /dev/sda | grep -E "Device Model|Serial Number|User Capacity"

Calculate cryptographic SHA-256 hash across first 100 MB of wiped storage: head -c 100M /dev/sda | sha256sum

Generate standard ITAD audit log record for GDPR Art. 32 / NIS2 compliance:

echo "[ITAD_CERT] DATE=$(date -u +%FT%TZ) SN=$(smartctl -i /dev/sda | awk -F: '/Serial/{print $2}' | xargs) METHOD=NIST-800-88-PURGE STATUS=VERIFIED OPERATOR=<user>"

Export immutable SMART diagnostics report before physical media destruction: smartctl -a /dev/sda > /root/itad-reports/sanitization-$(date +%F)-sda.txt

Final sanity audit (guarantee zero bootloader code remains in MBR/GPT sectors): fdisk -l /dev/sda | grep -iE "Disklabel type|Disk identifier"

🔌 SpecInfo Hardware Engineering Standard • OEM Diagnostic Matrix & Motherboard Faults

Laptop Motherboard LED & Blink Codes Triage

Dell Amber/White • HP CapsLock Blinks • Lenovo Melodies • EC/NVRAM Hard Reset • eDP & Thermal Paste

A4 Bench & Service Laminate CODE: HW-BLINK-A4 • REV 2026.1

🟡

1. Dell Diagnostic Blink Matrix (Amber / White)

2 Amber, 1 White: CPU subsystem failure / VCCCORE VRM stage missing Symptom: CPU unpowered • Action: Inspect VRM power rail inductors

2 Amber, 3 White: System Board, BIOS corruption or SPI flash communication fault Trigger: Hold ESC+CTRL while plugging AC for BIOS Auto-Recovery

2 Amber, 4 White: Memory module (RAM) subsystem failure or SPD read failure Action: Reseat SO-DIMM in single-slot configuration, clean golden contacts

2 Amber, 7 White: LCD / eDP display cable fault or blown VBL backlight fuse Test: Connect external HDMI/Type-C monitor to isolate display vs GPU

3 Amber, 5 White: Main Power Rail fault (3.3V / 5V ALW power good missing) Diagnosis: Short on secondary power rail (USB/Audio/Touchpad IC)

🔵

2. HP Diagnostic Blink Codes (Caps / NumLock)

3 Slow, 2 Fast (Code 3.2): Memory module not detected or failed SPD test Action: Swap DDR4/DDR5 SO-DIMM to Channel B; check socket pins

3 Slow, 4 Fast (Code 3.4): Power supply / DC-In adapter mismatch Cause: Smart Pin 19.5V resistor sense line broken / USB-C PD <45W

5 Slow, 2 Fast (Code 5.2): Embedded Controller (EC) firmware timeout Fix: Hold Windows + B + Power for 3s to roll back EC/UEFI SPI flash

5 Slow, 3 Fast (Code 5.3): System Board / Motherboard hardware fault Action: Disconnect battery and CMOS; perform 40s power button drain

5 Slow, 4 Fast (Code 5.4): Thermal trip / CPU heatsink contact failure Action: Verify fan tachometer RPM and inspect thermal interface paste

🔴

3. Lenovo ThinkPad Audio & Power Diagnostics

Smartfly Melody Audio: 5-tone sequence indicates CPU/Board POST freeze App: Use Lenovo PC Diagnostics smartphone app via microphone scan

Power Button 3 Blinks: AC power source detected and negotiated cleanly Status: USB-C PD 20V profile accepted by Cypress/TI PD controller

Power Button Rapid Loop: Modern Standby (S0ix) sleep freeze Workaround: Press Emergency Reset Hole with paperclip for 10 seconds

Emergency Reset Hole Action: Drops standby 3.3V power rail to EC and RTC Location: Bottom cover pinhole near model label (resets KBC state)

⚡

4. EC, NVRAM & BIOS Hard-Reset Shortcuts

DELL (BIOS Auto-Recovery): Force SPI reflash from hidden EFI partition: Hold ESC + CTRL while inserting AC power adapter until LED flashes

HP (Hardware UEFI Rollback): Roll back corrupt BIOS without screen output: Hold Windows Key + B (or Win + V) and press Power button for 3 seconds

LENOVO (RTC & Embedded Controller Cold Drain): Disconnect AC & battery • Press Reset hole 10s • Hold Power for 30s

ASUS & ACER (Universal RTC Clear): Clear corrupt NVRAM boot variables: Disconnect AC adapter • Press and hold Power button firmly for 40 seconds

🖥️

5. eDP Display Connector & VBL Fuse Triage

30-Pin eDP Pinout Standard: 2-lane eDP, max 1080p 60Hz: Pins 1-3: VBL (19V/20V Backlight) • Pin 6: LCD VDD (3.3V Logic)

40-Pin eDP Pinout Standard: 4-lane eDP, 144Hz+ / 4K / Touchscreen: Pins 38-40: VBL (19V/20V) • Pins 11-14: Auxiliary differential channels

CRITICAL SAFETY RULE: NEVER plug/unplug eDP cable with battery connected! Risk: 19V VBL shorting to adjacent 3.3V logic lines instantly kills CPU PCH

Blown Backlight Fuse (F1/F2) Triage: Flashlight test reveals faint desktop: Multimeter continuity test across SMD fuse near display connector (0Ω = OK)

❄️

6. Direct-Die Pump-Out & Thermal Triage

Pump-Out Effect Cause: Heatsink thermal expansion cycling on mobile bare dies: Silicon pastes (e.g. MX-4) pump out within 2-3 months • Delta-T rises >25°C

Phase Change Material (Honeywell PTM7950): Solid at room temp, melts at 45°C: Thermal conductivity: 8.5 W/mK • 0 pump-out • Expected lifespan: 5+ years

Liquid Metal (Gallium/Indium) Warning: High electrical short-circuit risk: Strictly prohibit on bare aluminum heatsinks (causes rapid galvanic corrosion)

PROCHOT Hardware Flag: Inspect thermal throttling status in PowerShell: Get-WmiObject -Namespace root\wmi -Class MSAcpi_ThermalZoneTemperature

🚨 SpecInfo Incident & Disaster Recovery • Field Rescue, WinPE & Power Rails Series

Disaster Recovery & Power Rails Triage

Motherboard Power Sequence • WinPE Swiss-Army-Knife • Linux Storage Health • Field Wi-Fi RF & S0ix Drain

A4 Field Rescue Laminate CODE: DIS-RECOV-A4 • REV 2026.1

⚡

1. Power Rails Sequence & Bench Amperage

Standard Power-Up Rail Sequence (Laptops / Micro-PCs): VBUS (19V/20V) ➔ 3.3V/5V ALW ➔ PCH/EC PowerGood ➔ SLP_S3 ➔ VCCCORE

Amperage Draw: 0.01A–0.02A Flat: Short circuit on 19V primary or dead EC: Check: DC-In input MOSFETs (PQ1/PQ2) and current sensing resistor PR1

Amperage Draw: 0.05A–0.15A Looping: Missing RAM power rail or corrupt SPI: Symptom: Power cycling every 2-3s • Action: Check DDR VDD (1.1V/1.2V)

Amperage Draw: 0.40A–0.80A Frozen: Missing VCCCORE / clock generator freeze: Action: Check CPU core PWM controller (ISL/NCP) and PLTRST# signal

🪟

2. WinPE Swiss-Knife: EFI & BCD Rescue

Format damaged EFI system partition and assign drive letter S: in WinPE: diskpart /s script.txt (sel disk 0, sel part 1, format quick fs=fat32, assign letter=S)

Rebuild complete UEFI bootloader structure from Windows install directory: bcdboot C:\Windows /s S: /f UEFI

Rebuild corrupted BCD store in-place on legacy MBR / Hybrid partitions: bootrec /fixmbr && bootrec /fixboot && bootrec /rebuildbcd

Re-register Windows Recovery Environment (WinRE) partition agent: reagentc /enable && reagentc /info

🔑

3. WinPE Offline Password & Driver Inject

Sticky Keys binary swap to spawn elevated CMD on Windows logon screen: copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe /Y

Reset local admin password offline after booting OS (press Shift 5 times): net user Administrator NewSecurePassword2026! /active:yes

Inject missing storage RAID or Ethernet driver in-flight without rebooting: drvload X:\drivers\storage_nic.inf

Initialize WinPE network stack and request fresh DHCP lease: wpeutil InitializeNetwork && ipconfig /renew

🐧

4. Linux Storage & PCIe Bus Health Triage

Detect PCIe Link Degradation (e.g. x4 drive running degraded at x1): lspci -vv | grep -E "LnkCap|LnkSta"

Execute non-destructive background SMART short self-test on NVMe/SATA: smartctl -t short /dev/nvme0n1

Dump controller internal hardware error log: smartctl -l error /dev/nvme0n1

📶

5. Field Wi-Fi & RF Packet Loss Triage

Generate comprehensive HTML wireless network and roaming diagnostics report: netsh wlan show wlanreport

Inspect all live access points, BSSID signal levels and channel overlap: netsh wlan show networks mode=bssid

Query live radio interface metrics (negotiated PHY rate, channel, RSSI): netsh wlan show interfaces

Restart wireless network adapter and purge auto-config cache in PowerShell: Get-NetAdapter -InterfaceDescription "*Wireless*" | Restart-NetAdapter

🔋

6. Modern Standby (S0ix) Battery Drain Fix

Diagnose sleep battery drainage and wake-source culprit with SleepStudy: powercfg /sleepstudy /output "C:\sleepstudy.html"

Check system sleep state capabilities (S0 Low Power Idle vs S3 Sleep): powercfg /a

Force network disconnection in standby to prevent laptop heating in backpacks: reg add "HKLM\System\CurrentControlSet\Control\Power" /v PlatformAoAcOverride /t REG_DWORD /d 0 /f

Identify active processes holding display or system sleep execution locks: powercfg /requests

☸️ SpecInfo Cloud-Native SRE • Docker Engine, Containerd & Kubernetes Triage

Docker & Kubernetes SRE Triage

Pod Crash Loops • Node Eviction & DiskPressure • CNI DNS Outages • Ephemeral Debug & RBAC Audit

A4 Field Rescue Laminate CODE: K8S-DOCK-A4 • REV 2026.1

💥

1. Pod Crash & Exit Status Triage

List all non-running, crashing, or evicted pods across all namespaces: kubectl get pods -A --field-selector status.phase!=Running | grep -v Completed

Triage CrashLoopBackOff & OOMKilled (Exit Code 137 = Memory Limit Exceeded): kubectl describe pod <pod> -n <namespace> | grep -E "State:|Reason:|Exit Code:|Last State:"

Fetch logs from terminated previous instance of crashing container: kubectl logs <pod> -n <namespace> -c <container> --previous --tail=100

Identify ImagePullBackOff & container registry authentication failures: kubectl get events -n <namespace> --field-selector reason=Failed --sort-by='.metadata.creationTimestamp'

🖥️

2. Node Conditions & SRE Eviction Triage

Inspect node health conditions (MemoryPressure, DiskPressure, PIDPressure): kubectl get nodes -o wide && kubectl describe node <node> | grep -A 6 "Conditions:"

Real-time CPU and Memory consumption per node and active pod: kubectl top nodes && kubectl top pods -A --sort-by=memory | head -n 15

Gracefully cordon and drain node for emergency host kernel maintenance: kubectl cordon <node> && kubectl drain <node> --ignore-daemonsets --delete-emptydir-data --force

Uncordon restored node and mark back schedulable in cluster: kubectl uncordon <node>

💾

3. Storage, Kubelet & Docker Disk Rescue

Check host root & /var/lib/kubelet filesystem usage and inode exhaustion: df -h / /var/lib/kubelet /var/lib/docker && df -i /var/lib/docker

Purge unused images on containerd nodes to resolve Kubelet DiskPressure: crictl rmi --prune && crictl rm $(crictl ps -a -q --state Exited)

Emergency purge dangling Docker images, dead containers and build cache: docker system prune -af --volumes

Triage stuck PersistentVolumeClaims (Pending / VolumeSubpathInitializationFailed): kubectl get pvc,pv -A | grep -v Bound && kubectl describe pvc <pvc> -n <namespace>

🌐

4. CNI, CoreDNS & Service Routing

Verify CoreDNS pod distribution, IP binding and live health logs: kubectl get pods -n kube-system -l k8s-app=kube-dns -o wide && kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50

Test in-cluster DNS resolution and latency via ad-hoc dnsutils pod: kubectl run dns-test -it --rm --image=busybox:1.28 --restart=Never -- nslookup kubernetes.default

Check Service EndpointSlices and target pod IP routing health: kubectl get svc,endpoints -n <namespace> <service>

Forward port locally from production pod/service for direct triage: kubectl port-forward svc/<service> 8080:80 -n <namespace> --address 0.0.0.0

🔍

5. Ephemeral Debug & Live Telemetry

Inject interactive network debug container (netshoot) into crashing pod namespace: kubectl debug -it <pod> -n <namespace> --image=nicolaka/netshoot --target=<container>

Stream real-time consolidated multi-container logs matching label selector: kubectl logs -f -l app=<app> -n <namespace> --max-log-requests=10 --tail=50

Docker live resource telemetry (CPU %, Mem usage/limit, Net I/O, PIDs): docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.PIDs}}"

Inspect lowest-level container process tree & host namespace mapping: crictl inspect <container_id> | grep -E "pid|io.kubernetes.pod.name"

🔒

6. RBAC Auth, Secrets & Certs

Verify ServiceAccount or user permissions against specific API operation: kubectl auth can-i create deployments --as=system:serviceaccount:<ns>:<sa> -n <ns>

Extract and decode Kubernetes base64 Secret data in one terminal pipeline: kubectl get secret <secret> -n <ns> -o jsonpath="{.data}" | jq 'map_values(@base64d)'

Audit kubeadm master control-plane certificates expiration dates: kubeadm certs check-expiration

Renew all cluster control-plane certificates before hard expiry blackout: kubeadm certs renew all && systemctl restart kubelet

⚡ SpecInfo Emergency Rescue Series • Sheet #16 • Zero-Install Production Certified

Linux Lifeline: Zero-Install Emergency Runbook

100% Disk Full • Ghost Space • Inode Depletion & SSH Lockout Triage for Hardened & Air-Gapped Nodes

A4 Field Rescue Laminate CODE: LINUX-LIFE-A4 • REV 2026.1

🔑

1. SSH Login Lockout & PTY Recovery [Zero-Install]

Bypass PTY Allocation Failure (one-shot execution when disk full): ssh -T root@host "journalctl --vacuum-size=200M"

Bypass Bash History Disk Error (launch shell with disabled history): ssh root@host "HISTFILE=/dev/null /bin/sh"

Instant 4% Root Reserve Release (reclaim ~20 GB ext4 blocks in 1s): tune2fs -m 1 /dev/sdX1

👻

2. Ghost Space & Procfs Truncate [Zero-Downtime]

Locate Unlinked Open Files without lsof (Zero-Install Coreutils): find /proc/*/fd -links 0 -type f 2>/dev/null | head -n 10

Safe Procfs Truncate (reclaim space without daemon restart): : > /proc/<PID>/fd/<FD>

Audit Active Process Descriptors holding deleted ghost files: ls -l /proc/*/fd/ 2>/dev/null | grep "(deleted)" | head -n 10

📁

3. Inode Collapse & Recovery (df -i 100%) [Coreutils]

Fast Directory Inode Audit (locate dirs with millions of files in seconds): find /var -xdev -printf '%h\n' | sort | uniq -c | sort -k1 -nr | head -n 5

Bypass 'Argument list too long' (ARG_MAX) when purging millions of files: find /path/to/bloated_dir -type f -delete

High-Speed Rsync Wipe (purges millions of entries 5x faster than rm -rf): mkdir /tmp/empty && rsync -a --delete /tmp/empty/ /target/bloated_dir/

⚡

4. 30-Second Emergency Disk Bleed Flush [Instant]

Systemd Journal Vacuum (safely trim logs without index corruption): journalctl --vacuum-size=500M

Crash Dumps & Scratch Prune (remove coredumps & tmp >3 days): find /var/lib/systemd/coredump /var/crash -type f -delete && find /tmp /var/tmp -xdev -type f -atime +3 -delete

Purge Large Rotated Logs (locate and truncate compressed legacy logs): find /var/log -type f -name '*.gz' -size +100M -delete

🐳

5. Docker Storage Leak & Overlay2 Choke [Containers]

Dead Layers & Unnamed Volumes Purge (reclaim 10-100 GB in /var/lib/docker): docker container prune -f && docker volume prune -f

Live Container JSON Log Truncate without restarting container: : > $(docker inspect --format='{{.LogPath}}' <container_id>)

Audit Top Inode-Consuming Container (inspect overlay layers): docker system df -v

🔬

6. Kernel Ring 0 Observability: eBPF Probes [Zero-Overhead]

Real-Time Inode Drain Watcher (catch process spamming inodes live): bpftrace -e 'kprobe:ext4_new_inode { printf("INODE ALLOC PID %d: %s\n", pid, comm); }'

Real-Time Ghost Space Detector (catch unlinked fd microsecond it occurs): bpftrace -e 'tracepoint:syscalls:sys_enter_unlinkat { printf("UNLINK PID %d: %s\n", pid, comm); }'

Trace disk block allocations per process under heavy write pressure: bpftrace -e 'kprobe:ext4_da_write_begin { @[comm] = count(); }'