Security writeups, tool internals, and practical guides.https://swatto.co.uk/https://swatto.co.uk/articles/parsing-every-log-format-logsleuth/https://swatto.co.uk/articles/parsing-every-log-format-logsleuth/Every application writes logs differently, and timestamps are a disaster. Here's the 15-heuristic fallback chain LogSleuth uses to parse them, and why it has to exist.Tue, 05 May 2026 00:00:00 GMThttps://swatto.co.uk/articles/reading-the-mft-directly-disksleuth/https://swatto.co.uk/articles/reading-the-mft-directly-disksleuth/Walking the directory tree is slow. When elevated, DiskSleuth reads the NTFS Master File Table directly — a million files in a few seconds instead of minutes.Fri, 01 May 2026 00:00:00 GMThttps://swatto.co.uk/articles/whats-holding-this-file-windows-locks/https://swatto.co.uk/articles/whats-holding-this-file-windows-locks/The 'file in use' dialog tells you nothing useful. SMB locks and local process handles are completely different problems — most tools only solve one of them.Sat, 18 Apr 2026 00:00:00 GMThttps://swatto.co.uk/articles/replacing-event-viewer-in-rust/https://swatto.co.uk/articles/replacing-event-viewer-in-rust/120,000 events, 45 seconds of hang. The Event Log API is fast — Event Viewer just uses it badly. Here's the fix, and the wevtutil one-liner that works when you can't install anything.Sat, 18 Apr 2026 00:00:00 GMThttps://swatto.co.uk/articles/building-secure-file-encryption/https://swatto.co.uk/articles/building-secure-file-encryption/I built SwatCrypt because I didn't trust myself to bolt crypto onto something else. Here's what I chose and why — cipher, KDF, and why unsafe code is banned at compile time.Fri, 10 Apr 2026 00:00:00 GMThttps://swatto.co.uk/articles/self-hosting-with-wazuh-and-crowdsec/https://swatto.co.uk/articles/self-hosting-with-wazuh-and-crowdsec/Attackers automate their scanning. My setup uses Wazuh for host-level visibility and CrowdSec for crowd-sourced blocking — here's why they work better together than either alone.Fri, 10 Apr 2026 00:00:00 GMThttps://swatto.co.uk/articles/tauri-vs-electron-2026/https://swatto.co.uk/articles/tauri-vs-electron-2026/I've shipped several tools with Tauri and maintained Electron apps. The size difference is real, but it's not the most interesting part.Fri, 10 Apr 2026 00:00:00 GMThttps://swatto.co.uk/articles/why-rust-for-desktop-tools/https://swatto.co.uk/articles/why-rust-for-desktop-tools/AI writes the code, but the language choice still matters. Rust's compiler guardrails catch whole categories of bug that would otherwise slip through unnoticed.Fri, 10 Apr 2026 00:00:00 GMT