Digital Forensics & Incident Response
DFIR combines digital forensics (the science of collecting and analyzing digital evidence) with incident response (the process of detecting, containing, and recovering from security breaches). This discipline is critical for understanding how attackers operate, preserving evidence for legal proceedings, and preventing future incidents.
Evidence Preservation is Critical
Incident Response Lifecycle
1. Identification
Detect and validate security incident
2. Containment
Prevent further damage (isolate systems)
3. Eradication
Remove threat from environment
4. Recovery
Restore systems to normal operations
5. Lessons Learned
Post-mortem analysis and improvements
DFIR vs Red Team
While red teams simulate attacks, DFIR professionals investigate and respond to them. These are complementary skillsets:
🔴 Red Team (Offensive)
- • Break into systems
- • Evade detection
- • Establish persistence
- • Simulate real attackers
- • Goal: Test defenses
🔵 DFIR (Defensive)
- • Investigate breaches
- • Find attacker artifacts
- • Reconstruct timelines
- • Contain and remediate
- • Goal: Understand and stop attacks
Essential DFIR Tools
Disk Forensics
- • Autopsy / Sleuth Kit
- • FTK Imager
- • X-Ways Forensics
- • Magnet AXIOM
Memory Forensics
- • Volatility 3
- • Rekall
- • DumpIt / Magnet RAM Capture
- • MemProcFS
Network Forensics
- • Wireshark / tshark
- • NetworkMiner
- • Zeek (Bro)
- • tcpdump
Windows Forensics
- • Eric Zimmerman Tools
- • RegRipper
- • Event Log Explorer
- • Velociraptor
Linux Forensics
- • SIFT Workstation
- • log2timeline / Plaso
- • osquery
- • Sysdig
Timeline & Analysis
- • Plaso / log2timeline
- • Timesketch
- • CyberChef
- • Elasticsearch / Kibana
The Forensic Process
- 1. Identification: Recognize potential evidence (compromised server, suspicious network traffic)
- 2. Preservation: Create forensic images with write-blockers, calculate MD5/SHA256 hashes
- 3. Collection: Gather volatile data (memory, running processes) before non-volatile (disk)
- 4. Analysis: Examine artifacts for IOCs, attacker tools, and lateral movement traces
- 5. Documentation: Maintain detailed chain of custody and findings report
- 6. Presentation: Communicate findings to technical and non-technical stakeholders
Order of Volatility
Guide Contents
DFIR Fundamentals
Methodology, evidence handling, and chain of custody.
Evidence Acquisition
Disk imaging, memory capture, and network captures.
Memory Forensics
RAM acquisition, analysis with Volatility, detecting rootkits.
Disk Forensics
Filesystem analysis, file carving, and deleted file recovery.
Windows Forensics
Event logs, registry analysis, prefetch, and MFT parsing.
Linux Forensics
Linux artifact analysis and log investigation.
Network Forensics
Packet analysis, flow analysis, and traffic reconstruction.
Incident Response
IR playbooks, containment strategies, and eradication.
Timeline Analysis
Building comprehensive attack timelines.