01 · Acquisition & Triage
Windows Acquisition and Triage with KAPE and Velociraptor
Acquire Windows evidence in the right order: memory first, disk images, BitLocker, KAPE and Velociraptor triage, cloud snapshots and chain of custody.
Articles tagged: #triage
01 · Acquisition & Triage
Windows Live Response: What to Capture, in Which Order
Windows live response in practice: order of volatility, memory first, processes, network and sessions, trusted tooling, hashing output and your own footprint.
01 · Acquisition & Triage
Getting Started with Windows Forensics
Start Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.