Digital Forensics

---
name: digital-forensics
description: Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
---

# Digital Forensics & IR Artifacts

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: Read `../field-journal/precedent-pentest.md` or the organization's IR authorization statement
2. `NOW`: Confirm this is **forensics/tracing**, not offensive scanning
3. `NOW`: Set up the case; work on read-only copies of evidence first (write-protect original media)
4. `NEXT`: tool-index; Volatility etc. are often manual installs
5. `ACT`: Preserve hashes → timeline → key artifacts

## Applicable Scenarios

- Memory dump analysis (Volatility 2/3)
- Disk / E01 / dropped-file timelines
- PCAP tracing and protocol reconstruction (can be combined with `protocol-reverse/`)
- Host artifacts: Prefetch, Shimcache, Event Logs, browser history
- IOC extraction for incident response (combined with `malware-analysis/` / `threat-hunting/`)

## Workflow

### 1. Preservation

```text
□ Compute SHA256; record timezone and acquisition commands
□ Work on a copy; keep the original read-only
□ Add chain-of-custody notes to the timeline
```

### 2. Memory

```bash
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline
```

### 3. Host Artifacts

```text
□ Event logs: Security / PowerShell / Sysmon
□ Persistence: Run keys, services, scheduled tasks, WMI
□ Execution traces: Amcache, Prefetch, BAM
```

### 4. Network

```text
□ tshark session and DNS statistics
□ Export suspicious streams → protocol-reverse or malware C2 analysis
```

## Toolchain

| Tool | Purpose |
|------|---------|
| Volatility 3 | Memory |
| Timeline Explorer / Plaso | Super timeline |
| tshark | PCAP |
| Eric Zimmerman's tools | Windows artifacts |
| Autopsy / FTK Imager | Disk |

## References

- `references/forensics-triage.md`
- `../malware-analysis/` `../threat-hunting/` `../protocol-reverse/`

## Routing Context

**Upstream**: MASTER R25  
**Downstream**: deeper malware sample analysis → malware-analysis; detection rules → threat-hunting

## Task Completion Checklist

- [ ] Were hashes and the copy strategy preserved?
- [ ] Is the timeline reviewable?
- [ ] Are IOCs sanitized and classified?
- [ ] Checklist?