01 · Acquisition & Triage
Windows Acquisition and Triage with KAPE and Velociraptor
Acquire Windows evidence in the right order: memory first, disk images, BitLocker, KAPE and Velociraptor triage, cloud snapshots and chain of custody.
21 in-depth guides
Guides
In-depth Windows DFIR guides: registry, event logs, execution, NTFS, persistence, lateral movement, USB, memory and timelines.
03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
08 · Lateral Movement
Credential Access Forensics: LSASS, DCSync and Kerberoasting
Investigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.
11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
07 · Persistence
Hunting Windows Persistence: Registry, Tasks, WMI and More
Find attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
05 · NTFS & File System
NTFS Forensics: $MFT, USN Journal and $LogFile Explained
Read NTFS like an examiner: MFT record structure, $SI vs $FN timestamps, timestomping checks, USN reason flags, $LogFile, $I30 slack and deleted files.
04 · Evidence of Execution
Phishing Forensics: MotW, ISO, LNK and Initial Access
Trace a phishing attack from email to first execution: Outlook temp files, Zone.Identifier, ISO and LNK MotW bypass, macros, OneNote, LOLBins and a timeline.
08 · Lateral Movement
Remote Access Tool Forensics: AnyDesk, TeamViewer and More
Investigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.