DFIR: Forensics and Evidence

• Forensic quality decides whether your evidence convinces regulators, courts, and executives — sloppy acquisition costs the case.
• Memory-first ordering is the discipline that is hardest to relearn under pressure; practicing it matters.
• Timelines built from reliable artifacts are the narrative backbone of every IR report.

You photograph the scene, bag the fragile items, and only then tidy — the evidence has priority over cleaning.

• Volatility order: running processes, memory, active network, then disk — capture what disappears first.
• Acquisition: hashing before and after, write-blocked copies, hashed evidence containers.
• Artifacts: registry, prefetch/amcache, event logs, browser databases, and scheduled tasks tell the 'what ran' story.
• Timeline correlation overlays artifacts with SIEM/network logs to sequence the attack.

• An IR team images memory from a compromised web host and finds the injected payload that code review missed.
• A forensics pass builds a timeline through scheduled-task + event-log artifacts, scoping the incident to 6 minutes.
• A compliance case pins login anomalies to a stolen session through browser-cache and auth logs cross-referenced.

• Capture memory before disk, always, with a tool you practiced on your own lab.
• Hash at acquisition and re-hash at custody transfer; record who touched what.
• Analyze copies only; keep the pristine evidence in an offline container.
• Timeline generation from machine timezones consistently; UTC everywhere avoids the midnight trap.

• Rebooting the box to 'get a clean state', destroying the exact memory evidence that mattered.
• Analyzing the live disk while the attacker still writes, contaminating the acquisition.
• Trusting one artifact type; cross-artifact corroboration is the method.
• Charging a timeline with un-normalized clocks across the estate, so the story bends.

• Start lateral: DNS cache + browser artifacts often reveal the C2 before process memory does.
• Keep a notes file with every command you ran against the copy — reproducibility IS the defense.
• Involve a second pair of eyes on the timeline; the narrative improves or falls.

• Forensic data is deeply sensitive; restrict and encrypt evidence stores, log all access.
• Chain-of-custody applies even internally — a case may travel to a regulator's counsel.