forensics

What I do

• Collect digital evidence properly
• Analyze forensic artifacts
• Preserve chain of custody
• Document findings for legal proceedings
• Investigate security incidents
• Recover deleted data

When to use me

When investigating security incidents, responding to breaches, or conducting digital forensics investigations.

Evidence Collection

Order of Volatility

1. CPU registers, cache
2. Network connections
3. Running processes
4. Memory (RAM)
5. Network traffic
6. Disk
7. Remote logs
8. Physical config
9. Media (archival)

Collection Methods

• Write blockers
• Forensic images (DD, E01)
• Hash verification
• Live vs dead collection
• Remote collection

Chain of Custody

• Document every access
• Secure storage
• Timestamps
• Who/what/when/why

Forensic Analysis

Memory Forensics

• RAM dump analysis
• Volatile data extraction
• Malware detection
• Rootkit identification

Disk Forensics

• File recovery
• Deleted file analysis
• Metadata examination
• Timeline analysis
• Slack space

Network Forensics

• Packet capture analysis
• Flow analysis
• Malware communication
• Intrusion detection

Browser Forensics

• History extraction
• Cookies analysis
• Cache examination
• Bookmarks

Email Forensics

• Header analysis
• Attachment extraction
• Phishing analysis

Common Artifacts

Windows

• Event logs (Security, System, Application)
• Registry (NTUSER.DAT, SAM, SECURITY)
• Prefetch
• Jumplists
• Recent files
• Recycle Bin

Linux

• Bash history
• System logs (/var/log)
• Audit logs
• Cron jobs
• SSH keys

macOS

• Unified logs
• Spotlight
• HFS+/APFS metadata
• Keychain
• Safari artifacts

Tools

• EnCase: Commercial forensics
• FTK: Full toolkit
• Autopsy: Open source
• Volatility: Memory forensics
• Wireshark: Network analysis
• The Sleuth Kit: File system analysis

Reporting

• Executive summary
• Technical findings
• Evidence catalog
• Recommendations
• Expert testimony preparation