01 · Acquisition & Triage
Windows Acquisition and Triage with KAPE and Velociraptor
Acquire Windows evidence in the right order: memory first, disk images, BitLocker, KAPE and Velociraptor triage, cloud snapshots and chain of custody.
Articles tagged: #dfir
03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
08 · Lateral Movement
Credential Access Forensics: LSASS, DCSync and Kerberoasting
Investigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.
11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
07 · Persistence
Hunting Windows Persistence: Registry, Tasks, WMI and More
Find attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
05 · NTFS & File System
NTFS Forensics: $MFT, USN Journal and $LogFile Explained
Read NTFS like an examiner: MFT record structure, $SI vs $FN timestamps, timestomping checks, USN reason flags, $LogFile, $I30 slack and deleted files.
04 · Evidence of Execution
Phishing Forensics: MotW, ISO, LNK and Initial Access
Trace a phishing attack from email to first execution: Outlook temp files, Zone.Identifier, ISO and LNK MotW bypass, macros, OneNote, LOLBins and a timeline.
08 · Lateral Movement
Remote Access Tool Forensics: AnyDesk, TeamViewer and More
Investigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.
04 · Evidence of Execution
SRUM Forensics: App Usage and Network Bytes per Hour
Use SRUM (SRUDB.dat) to prove which apps ran, under which user, and how many bytes they sent: tables, ID mapping, dirty database repair, SrumECmd, pitfalls.
09 · USB & External Devices
USB Device Forensics: Tracing Drives, Users and Files
Identify every USB drive connected to a Windows host, date its connections, tie it to a user and prove which files were opened from it, step by step.
06 · User Activity
User Activity Forensics: ShellBags, LNK Files and Jump Lists
Prove which files and folders a Windows user opened, and when: ShellBags, LNK files, Jump Lists, MRU keys, Office Trust Records and Timeline, correlated.
06 · User Activity
Browser Forensics on Windows: Chrome, Edge and Firefox
Investigate Chrome, Edge and Firefox on Windows: History, downloads, cookies, sessions, extensions, WebKit and PRTime timestamps, WAL and deleted records.
03 · Event Logs
Windows Event Log Forensics: EVTX, Event IDs and Hunting
A practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.
01 · Acquisition & Triage
Windows Live Response: What to Capture, in Which Order
Windows live response in practice: order of volatility, memory first, processes, network and sessions, trusted tooling, hashing output and your own footprint.
10 · Memory Forensics
Windows Memory Forensics with Volatility 3: Practical Guide
Acquire Windows RAM, use hiberfil and pagefile, and run a Volatility 3 workflow to find injected code, hidden processes and network activity.
02 · Registry
Windows Registry Forensics: Hives, Keys and Workflow
Windows registry forensics in practice: hive files, transaction logs, control sets, LastWrite limits, deleted keys, the keys that matter and RECmd workflows.
06 · User Activity
Windows Search Index Forensics: Windows.edb and Windows.db
Mine the Windows Search index for file paths, dates, content snippets, Outlook mail and deleted-file remnants: Windows.edb, Windows.db, tools and pitfalls.
12 · Timeline Analysis
Building a Super Timeline with Plaso
Build and filter a Windows super timeline with Plaso: log2timeline, psteal and psort flags, time zones, MACB, Timeline Explorer, EZ Tools CSVs and pivoting.
04 · Evidence of Execution
Evidence of Execution: Prefetch, Amcache, BAM and More
Prove a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.
01 · Acquisition & Triage
Getting Started with Windows Forensics
Start Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.