used unfurl (https://dfir.blog/unfurl/) by @_RyanBenson for the first time for an investigation today and it was 🔥