01 · Acquisition & Triage
Getting Started with Windows Forensics
Start Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.
Area 01
Acquisition & Triage
Every Windows investigation starts with getting the data out safely. This area covers the order of volatility, memory capture, forensic imaging and hashing, BitLocker, triage collection with KAPE and Velociraptor, and the documentation that keeps your findings defensible.
Key sources
- KAPE
- FTK Imager
- Velociraptor
Guides in this area
01 · Acquisition & Triage
Windows Acquisition and Triage with KAPE and Velociraptor
Acquire Windows evidence in the right order: memory first, disk images, BitLocker, KAPE and Velociraptor triage, cloud snapshots and chain of custody.
01 · Acquisition & Triage
Windows Live Response: What to Capture, in Which Order
Windows live response in practice: order of volatility, memory first, processes, network and sessions, trusted tooling, hashing output and your own footprint.
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Volume Shadow Copies (VSS)Volume Shadow Copies cheat sheet: store files in System Volume Information, copy-on-write blocks, deletion by ransomware, mounting and parsing.
- hiberfil.sys (hibernation file)hiberfil.sys cheat sheet: what hibernation and Fast Startup save, compression by Windows version, converting it to a raw memory image and what it can reveal.
- pagefile.sys and swapfile.syspagefile.sys and swapfile.sys cheat sheet: paged-out memory on disk, what can be recovered, ClearPageFileAtShutdown, compression caveats and carving tools.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.