06 Digital Forensics

Welcome to:

Module 06 — Digital Forensics

In the previous module, you learned how to:

Prepare

Detect

Investigate

Contain

Eradicate

Recover

from a security incident.

But during a serious incident, one question often remains:

Exactly
What Happened?

You may know that:

A Host Was Compromised

but still need to determine:

How Did the Attacker
Gain Access?

What Did They Execute?

What Files
Did They Touch?

Did They Create
Persistence?

Were Credentials
Accessed?

Did They Move
to Other Systems?

Was Data
Exfiltrated?

When Did
Each Action Occur?

This is where:

Digital Forensics

becomes critical.

Digital forensics is the disciplined process of:

Identify

Preserve

Collect

Examine

Analyze

Correlate

Document

digital evidence so that security teams can reconstruct activity and support defensible conclusions.

Module Objectives

By the end of this module, you will understand how to:

• explain the role of digital forensics.

• understand the relationship between DFIR and incident response.

• identify digital evidence sources.

• understand evidence preservation.

• understand chain of custody.

• understand forensic integrity.

• understand forensic acquisition.

• distinguish live and dead-box acquisition.

• understand disk imaging.

• understand memory acquisition.

• understand forensic hashes.

• understand file-system analysis.

• understand timestamps and metadata.

• analyze deleted files.

• understand Windows forensic artifacts.

• understand Windows Registry artifacts.

• understand Prefetch.

• understand Shimcache and Amcache.

• understand Windows event logs.

• analyze PowerShell artifacts.

• analyze scheduled tasks and services.

• understand Linux forensic artifacts.

• analyze authentication and system logs.

• analyze shell history.

• understand memory forensics.

• investigate running processes.

• investigate network connections.

• investigate injected processes.

• investigate credential access indicators.

• analyze browser artifacts.

• analyze downloads and browsing history.

• analyze persistence.

• analyze malware artifacts.

• understand timeline analysis.

• build forensic timelines.

• correlate endpoint, identity and network evidence.

• understand network forensics.

• understand cloud forensic evidence.

• preserve cloud evidence.

• distinguish facts from forensic hypotheses.

• document forensic findings.

• create defensible forensic reports.

1 — What Is Digital Forensics?

Digital forensics is the process of identifying, preserving, examining and analyzing digital information to determine:

What Happened?

When?

How?

By Whom?

On Which Systems?

With What Impact?

2 — Digital Forensics and Incident Response

Digital forensics and incident response are closely related.

Incident Response asks:

How Do We
Control the Incident?

Digital Forensics asks:

What Does
the Evidence Tell Us?

Together:

DFIR

means:

Digital Forensics
+
Incident Response

3 — Incident Response vs Forensics

Incident response prioritizes:

Containment

Business Recovery

Threat Removal

Forensics prioritizes:

Evidence

Reconstruction

Attribution of Activity

Timeline

Technical Understanding

These goals sometimes create tension.

For example:

Immediately Rebooting
a Compromised Host

may help operations.

But it may destroy:

Memory Evidence

Therefore responders must balance:

Operational Need
+
Evidence Preservation

4 — Forensic Questions

A forensic investigation may need to answer:

How Did
the Attacker Enter?

What Account
Was Used?

What Process
Executed?

What Persistence
Was Created?

What Data
Was Accessed?

Did Lateral Movement
Occur?

Was Anything
Exfiltrated?

When Did
the Incident Begin?

5 — Evidence Sources

Digital evidence may come from:

Disk

Memory

File System

Registry

Event Logs

Processes

Network Connections

Browser Data

Email

Cloud Logs

Identity Logs

Security Tools

6 — Evidence Types

Evidence may be:

Volatile

Non-Volatile

7 — Volatile Evidence

Volatile evidence may disappear when a system is shut down.

Examples:

RAM

Running Processes

Network Connections

Logged-On Users

Temporary Data

8 — Non-Volatile Evidence

Non-volatile evidence generally remains after shutdown.

Examples:

Disk

Files

Logs

Registry

Browser History

Database Records

9 — Order of Volatility

Investigators may prioritize evidence according to how quickly it can disappear.

Conceptually:

CPU / Memory
      ↓
Network State
      ↓
Running Processes
      ↓
Temporary Files
      ↓
Disk
      ↓
Archived Logs

Follow approved forensic procedures for your environment.

10 — Evidence Preservation

Evidence should be preserved in a manner that maintains:

Integrity

Authenticity

Traceability

11 — Forensic Integrity

The investigator should avoid unnecessary modification of evidence.

A professional question is:

Did My
Investigation Activity
Change the Evidence?

Some change may be unavoidable during live response.

Document it.

12 — Chain of Custody

Chain of custody records:

What Was Collected?

Who Collected It?

When?

From Where?

How?

Who Accessed It?

Where Was
It Stored?

13 — Why Chain of Custody Matters

It demonstrates that evidence was:

Controlled

Traceable

Protected

from collection through analysis.

14 — Evidence Register

Create:

Forensic_Evidence_Register.csv

with:

Evidence ID	Source	Artifact	Collection Time	Collector	Hash	Storage

15 — Forensic Hashing

A cryptographic hash can help demonstrate that evidence has not changed.

Common examples:

SHA-256

Conceptually:

Evidence
      ↓
Hash
      ↓
Recorded

Later:

Evidence
      ↓
Hash Again
      ↓
Compare

16 — Hash Match

If the hash remains the same:

Evidence
Likely Unchanged

If different:

Investigate

17 — Original vs Working Copy

Do not perform unnecessary analysis directly on the original evidence.

Use:

Original Evidence
      ↓
Protected
      ↓
Verified Working Copy
      ↓
Analysis

18 — Forensic Acquisition

Acquisition is the process of collecting forensic data.

Potential acquisition types include:

Disk Image

Memory Image

Log Export

Cloud Snapshot

File Collection

Network Capture

19 — Live Acquisition

Live acquisition occurs while the system is running.

Useful for collecting:

Memory

Processes

Connections

Logged-On Users

Encryption Keys

20 — Dead-Box Acquisition

Dead-box acquisition generally involves analyzing a system after it has been powered down.

Benefits may include:

Reduced System Change

Controlled Disk Acquisition

But volatile evidence may already be lost.

21 — Disk Imaging

A forensic disk image attempts to capture a complete representation of storage.

It may include:

Active Files

Deleted Data

Unallocated Space

File-System Metadata

22 — Logical vs Physical Acquisition

Logical acquisition may collect:

Selected Files

Folders

Artifacts

Physical acquisition may capture:

Complete Storage

including areas not normally visible through the operating system.

23 — Memory Acquisition

Memory may reveal:

Running Processes

Network Connections

Injected Code

Credentials

Encryption Keys

Command History

Malware

24 — Memory Is Time Sensitive

If the system is rebooted:

Memory Evidence
May Be Lost

This is why responders must decide quickly whether memory collection is required.

25 — File-System Forensics

File-system analysis helps answer:

Which Files
Exist?

When Were
They Created?

Modified?

Accessed?

Deleted?

26 — File Metadata

Useful metadata may include:

File Name

Path

Size

Owner

Creation Time

Modification Time

Hash

27 — MAC Times

You may encounter:

Modified

Accessed

Changed / Created

timestamps depending on file system and tooling.

Interpret timestamps carefully.

28 — Timestamp Limitations

Timestamps can be affected by:

Copying

Extraction

Time Zones

Application Behavior

Attacker Manipulation

Do not treat one timestamp as absolute proof without context.

29 — Deleted Files

Deleting a file may remove its reference without immediately erasing all underlying data.

Forensic tools may sometimes recover:

Deleted Files

File Fragments

Metadata

30 — Unallocated Space

Unallocated space can contain remnants of deleted information.

This may help uncover:

Deleted Malware

Documents

Archives

Scripts

31 — Windows Forensics

Windows systems provide rich forensic artifacts.

Important areas include:

Event Logs

Registry

Prefetch

Amcache

Shimcache

NTFS Metadata

PowerShell

Scheduled Tasks

Services

Browser Data

32 — Windows Event Logs

Useful log categories may include:

Security

System

Application

PowerShell

Task Scheduler

Defender

33 — Authentication Evidence

Windows logs may reveal:

Successful Logon

Failed Logon

Account Changes

Privilege Use

Group Changes

34 — Process Evidence

Process creation events may provide:

Process Name

Parent Process

Command Line

User

Timestamp

35 — Parent-Child Analysis

A process relationship such as:

winword.exe
      ↓
powershell.exe

may be important.

But context is required.

36 — Windows Registry

The Registry stores configuration and activity information.

Potential forensic value includes:

Persistence

User Activity

USB Devices

Programs

System Configuration

37 — Registry Persistence

Attackers may use locations that cause programs to start automatically.

Forensic analysis may identify:

Unexpected
Autorun Entries

38 — Prefetch

Windows Prefetch may provide evidence that:

An Executable
Ran

and can help determine:

Program

Execution History

Related Files

depending on system configuration.

39 — Prefetch Limitation

Absence of Prefetch does not prove:

Program
Never Executed

The feature may be:

Disabled

Unavailable

Cleaned

40 — Shimcache

Shimcache, often referred to as Application Compatibility Cache, may provide historical information about executables.

It can help with:

Program Presence

Potential Execution Context

Interpretation should be done carefully.

41 — Amcache

Amcache may contain information about applications and executable files.

Useful attributes can include:

File Path

Hash Information

Program Metadata

42 — PowerShell Forensics

PowerShell artifacts may reveal:

Commands

Scripts

Execution

Downloads

Encoded Content

Potential evidence sources include:

PowerShell Logs

Event Logs

EDR

Command History

43 — Encoded PowerShell

Encoded content may be:

Administrative

Obfuscated

Malicious

Decode and analyze the behavior.

Do not conclude solely from encoding.

44 — Scheduled Tasks

Scheduled tasks may support:

Administration

Automation

Persistence

Execution

Analyze:

Task Name

Creator

Command

Trigger

User

Creation Time

45 — Services

Services can also be used for:

Persistence

Execution

Lateral Movement

Investigate:

Service Name

Binary Path

Creator

Start Type

Timestamp

46 — Windows Timeline Sources

A Windows forensic timeline may correlate:

Event Logs

File Timestamps

Registry

Prefetch

Browser

EDR

Network

47 — Linux Forensics

Linux forensic evidence may include:

Authentication Logs

System Logs

Audit Logs

Shell History

Cron Jobs

Services

SSH Keys

Files

48 — Linux Authentication

Investigate:

SSH Login

Failed Login

sudo

su

Account Changes

49 — Shell History

Shell history may provide:

Commands
Executed by
Users

But attackers may:

Delete

Disable

Modify

history.

Therefore it is supporting evidence, not guaranteed truth.

50 — Linux Persistence

Potential areas include:

Cron

Systemd Services

Shell Profiles

SSH Keys

Startup Scripts

51 — SSH Forensics

Review:

Authorized Keys

Login Sources

Users

Authentication Methods

Commands

52 — Memory Forensics

Memory analysis provides insight into system state at a specific point in time.

It may reveal:

Processes

DLLs

Network Connections

Injected Code

Credentials

Malware

53 — Process Analysis

Start with:

Which Processes
Were Running?

Then investigate:

Parent

Child

Command Line

Path

Signer

Network

54 — Suspicious Process Indicators

Examples:

Unexpected Path

Unusual Parent

Unsigned Binary

Injected Memory

Rare Process

Suspicious Network Activity

55 — Process Injection

Attackers may inject code into legitimate processes.

Potential indicators include:

Unexpected
Memory Regions

Suspicious Threads

Process Behavior

56 — Memory Network Analysis

Memory may reveal active or recently active:

Network Connections

Listening Ports

Remote Addresses

57 — Credential Evidence

Memory may contain sensitive authentication material.

Handle this evidence carefully.

Do not expose or redistribute credentials unnecessarily.

58 — Browser Forensics

Browser artifacts may help reconstruct:

Visited Sites

Searches

Downloads

Cookies

Sessions

Cached Files

59 — Browser History

Useful questions:

Which URL
Was Visited?

When?

By Which User?

What Happened Next?

60 — Download History

Browser downloads can identify:

Downloaded File

Source URL

Timestamp

Destination Path

61 — Browser Sessions

Cookies or session data may help explain authenticated activity.

Treat session artifacts as sensitive.

62 — Email Forensics

Email evidence may include:

Headers

Body

Attachments

URLs

Delivery Information

Authentication Results

63 — Email Headers

Headers can help identify:

Sender Path

Mail Servers

Message IDs

Authentication Results

64 — Attachment Analysis

Investigate:

File Name

Type

Hash

Metadata

Behavior

in approved analysis environments.

65 — Network Forensics

Network forensic evidence can include:

Packet Capture

Firewall Logs

Proxy Logs

DNS Logs

Flow Data

IDS Events

66 — Packet Capture

Packet capture may reveal detailed network communication.

Potential information:

Source

Destination

Protocol

Content

Timing

depending on encryption and capture scope.

67 — Flow Data

Flow data provides metadata such as:

Source

Destination

Ports

Bytes

Duration

without necessarily containing packet payloads.

68 — DNS Forensics

DNS may help answer:

Which Domains
Did the Host
Resolve?

When?

How Often?

69 — Proxy Forensics

Proxy logs may reveal:

URLs

Downloads

Uploads

Users

Destinations

70 — Firewall Forensics

Firewall evidence may help determine:

Was Connection
Allowed?

Blocked?

Which Rule?

Which Direction?

71 — Network Timeline

Example:

10:14
DNS Query

10:14
Outbound Connection

10:15
Large Download

10:20
Repeated C2 Traffic

72 — Cloud Forensics

Cloud environments create different forensic challenges.

Evidence may include:

Audit Logs

Identity Events

Resource Configuration

Storage Logs

Snapshots

Network Logs

Security Findings

73 — Cloud Audit Evidence

Cloud audit logs may reveal:

Identity

API

Resource

Source IP

Timestamp

Result

74 — Cloud Identity Forensics

Investigate:

Login

Role Assumption

Access Key

Token

Privilege Change

75 — Cloud Resource Forensics

Analyze:

VM Changes

Storage Access

Security Group Changes

IAM Policies

Logging Configuration

76 — Cloud Evidence Preservation

Potential techniques include:

Export Audit Logs

Create Disk Snapshot

Preserve Object Versions

Capture Configuration

Record IAM State

following approved procedures.

77 — Cloud Evidence Is Dynamic

Cloud resources may be:

Created

Modified

Deleted

very quickly.

Evidence collection should be timely.

78 — Container Forensics

Container environments may require analysis of:

Container Image

Running Container

Logs

Host

Orchestrator Events

Registry

79 — Ephemeral Workloads

Containers may exist only briefly.

This makes:

Central Logging

Runtime Telemetry

Image Records

especially important.

80 — Malware Forensics

Malware analysis can involve:

Static Analysis

Dynamic Analysis

Behavioral Analysis

81 — Static Analysis

Static analysis examines a file without executing it.

Potential areas:

Hash

Strings

Headers

Imports

Metadata

82 — Dynamic Analysis

Dynamic analysis observes malware execution in an approved isolated environment.

Potential behaviors:

Processes

Files

Registry

Network

Persistence

83 — Malware Safety

Never execute unknown malware on:

Production

Personal Systems

Uncontrolled Networks

Use approved isolated lab environments.

84 — Malware Indicators

Potential indicators include:

File Hash

Domain

IP

Mutex

Registry Key

File Path

Process Behavior

85 — IOC Extraction

Forensic analysis may produce IOCs.

Example:

Hash

C2 Domain

File Path

These can support:

Threat Hunting

Detection

Blocking

86 — Behavioral Findings

Do not stop with IOCs.

Also identify:

Execution

Persistence

Credential Access

Lateral Movement

C2

behaviors.

87 — Timeline Analysis

Timeline analysis is one of the most important forensic techniques.

It combines multiple sources to reconstruct:

Sequence
of Events

88 — Super Timeline Concept

A broad timeline may combine:

File System

Windows Logs

Registry

Browser

EDR

Network

Cloud

into one chronological view.

89 — Timeline Example

08:41
Phishing Email Received

08:47
Browser Opens URL

08:51
File Downloaded

08:53
winword.exe Executes

08:54
powershell.exe Starts

08:55
External Connection

09:02
Scheduled Task Created

09:30
Credential Access

10:10
Lateral Movement

90 — Timeline Interpretation

Do not confuse:

Timestamp Correlation

with:

Causation

Events close in time may still be unrelated.

Validate relationships.

91 — Forensic Correlation

Correlation may connect:

User

Host

Process

File

IP

Domain

Cloud Identity

92 — Entity-Based Investigation

Example:

User A
      ↓
Host B
      ↓
Process C
      ↓
Domain D

Pivot between these entities.

93 — Cross-Source Correlation

Example:

Identity Log
Successful Login
      ↓
Windows Log
Process Execution
      ↓
DNS Log
Rare Domain
      ↓
Firewall
Outbound Connection

This provides stronger evidence than one artifact alone.

94 — Initial Access Analysis

Ask:

What Was
the Earliest
Known Malicious
Activity?

Possible sources:

Email

Web

VPN

Identity

Exploit Logs

95 — Persistence Analysis

Search:

Scheduled Tasks

Services

Registry

Startup

Accounts

Cloud Roles

OAuth

96 — Privilege Escalation Analysis

Look for:

New Admin Role

Elevated Token

Privilege Group Change

Policy Modification

97 — Credential Access Analysis

Potential evidence:

LSASS Access

Credential Tool

Browser Credential Access

Secrets Files

Cloud Credentials

98 — Discovery Analysis

Attackers may query:

Users

Groups

Hosts

Networks

Cloud Resources

99 — Lateral Movement Analysis

Investigate:

RDP

SMB

Remote Services

SSH

Remote PowerShell

Cloud Role Switching

100 — Collection Analysis

Look for:

Archive Creation

Mass File Access

Database Export

Cloud Object Collection

101 — Exfiltration Analysis

Correlate:

Collection
      ↓
External Connection
      ↓
Large Transfer

102 — Defense Evasion Analysis

Search for:

Log Clearing

Security Agent Stop

Logging Disablement

File Deletion

Timestomping

103 — Timestomping

Attackers may manipulate file timestamps to hide activity.

This is why analysts should correlate:

Multiple Artifacts

rather than trust file timestamps alone.

104 — Anti-Forensics

Attackers may attempt to destroy or hide evidence.

Examples:

Clear Logs

Delete Files

Modify Timestamps

Disable Logging

Encrypt Data

105 — Missing Evidence

Missing evidence may itself be important.

Example:

Logs Exist
Before Incident

Gap

Logs Resume
After Incident

Investigate:

Was Logging
Disabled?

106 — Facts vs Forensic Hypotheses

Observed:

Scheduled Task
Created at 09:02

Hypothesis:

Attacker Created It
for Persistence

Validate with:

Creator

Command

Related Activity

Timeline

107 — Confidence Levels

You may classify conclusions as:

Confirmed

High Confidence

Moderate Confidence

Low Confidence

Unknown

based on evidence.

108 — Avoid Overstatement

Do not report:

Attacker Stole
Customer Database

if evidence only shows:

Database Export
Was Created

You still need evidence of:

Transfer

109 — Forensic Investigation Workflow

Use:

Scope
      ↓
Preserve
      ↓
Collect
      ↓
Validate
      ↓
Examine
      ↓
Analyze
      ↓
Correlate
      ↓
Timeline
      ↓
Conclusion
      ↓
Report

110 — Scope

Define:

Systems

Users

Period

Incident

Evidence Sources

111 — Preserve

Protect evidence from:

Modification

Deletion

Loss

112 — Collect

Acquire relevant:

Disk

Memory

Logs

Network

Cloud

Application

evidence.

113 — Validate

Verify:

Integrity

Source

Time

Scope

114 — Examine

Identify relevant artifacts.

115 — Analyze

Determine:

Meaning

Relationships

Behavior

116 — Correlate

Connect evidence from multiple sources.

117 — Build Timeline

Reconstruct chronological activity.

118 — Conclusion

State:

What the
Evidence Supports

not what you merely suspect.

119 — Report

Document:

Methods

Evidence

Findings

Timeline

Limitations

Conclusion

120 — Forensic Workpaper

Create:

Forensic_Workpaper.md

with:

# Case ID

# Investigation Objective

# Scope

# Systems

# Time Period

# Evidence Sources

# Evidence Integrity

# Acquisition Method

# Artifacts Reviewed

# Findings

# Timeline

# IOCs

# ATT&CK Mapping

# Limitations

# Analyst Conclusion

121 — Forensic Timeline

Create:

Forensic_Timeline.csv

with:

Timestamp	Source	Host	User	Event	Evidence	Significance

122 — Artifact Register

Create:

Forensic_Artifact_Register.csv

with:

Artifact ID	Host	Artifact	Type	Timestamp	Finding	Confidence

123 — IOC Register

Create:

Forensic_IOC_Register.csv

with:

IOC	Type	Evidence Source	Confidence	First Seen	Last Seen

124 — Findings Register

Create:

Forensic_Findings.csv

with:

Finding ID	Evidence	Observation	Interpretation	Confidence

125 — Forensic Report Structure

Create:

Forensic_Report.md

with:

# Executive Summary

# Incident Background

# Scope

# Evidence Collected

# Methodology

# Timeline

# Technical Findings

# Initial Access

# Execution

# Persistence

# Credential Access

# Lateral Movement

# Command and Control

# Collection

# Exfiltration

# Impact

# Indicators

# Limitations

# Conclusion

# Recommendations

126 — Executive Forensic Summary

Executives typically need:

What Happened?

When?

Which Systems?

What Data?

Current Risk?

What Needs
to Happen?

They generally do not need every Registry key in the first summary.

127 — Technical Forensic Detail

Technical teams may need:

Hashes

Commands

Processes

Registry Paths

Services

IPs

Domains

Timestamps

128 — Forensic Limitations

Always document limitations such as:

Missing Logs

Short Retention

System Reboot

No Memory Image

Incomplete Disk Image

Encryption

Time Synchronization Issues

129 — Why Limitations Matter

A professional forensic conclusion should explain not only:

What We Know

but also:

What We
Cannot Determine

130 — Evidence Confidence

Example:

High Confidence:

PowerShell executed
at 08:54

because:

Windows Event

EDR

Prefetch

all support it.

131 — Lower Confidence Example

Possible:

User intentionally
executed malware

if the evidence does not demonstrate intent.

132 — Attribution Caution

Digital forensics may establish:

Account Used

Host Used

IP Used

This does not automatically prove:

Specific Human
Performed the Action

133 — Forensics and Detection Engineering

Forensics can reveal behaviors that existing detections missed.

Forensic Finding
      ↓
Attack Behavior
      ↓
Telemetry
      ↓
Detection Opportunity

134 — Forensics and Threat Hunting

After identifying:

Persistence Artifact

hunt:

Across
the Environment

for similar artifacts.

135 — Forensics and Incident Response

Forensic evidence helps response teams determine:

Scope

Persistence

Credentials

Lateral Movement

Impact

136 — Forensics and Lessons Learned

After the investigation:

Evidence
      ↓
Attack Timeline
      ↓
Control Gap
      ↓
Detection Gap
      ↓
Improvement

137 — Digital Forensics Tool Categories

You may encounter tools for:

Disk Forensics

Memory Forensics

Timeline Analysis

Network Analysis

Malware Analysis

Log Analysis

The objective is not to memorize one product.

Learn:

What Evidence
You Need

and

What Question
You Are Trying
to Answer

138 — Forensic Analysis Mindset

Do not start with:

Which Tool
Should I Use?

Start with:

What Question
Must I Answer?

Which Evidence
Could Answer It?

139 — Example Investigation Question

Question:

Did the Attacker
Create Persistence?

Potential evidence:

Scheduled Tasks

Services

Registry

Startup

Cloud IAM

OAuth

140 — Another Investigation Question

Question:

Was Data
Exfiltrated?

Evidence:

File Access

Archive Creation

Proxy

Network Flow

Cloud Upload

External Storage

141 — Forensic Decision Model

Use:

Question
      ↓
Evidence
      ↓
Artifact
      ↓
Correlation
      ↓
Conclusion

not:

Tool Output
      ↓
Conclusion

Practical Exercise 1 — Evidence Prioritization

Scenario:

A compromised Windows endpoint is still running.

Identify the collection priority for:

Memory

Processes

Network Connections

Disk

Event Logs

Explain why.

Practical Exercise 2 — Build Chain of Custody

Create a chain-of-custody record for:

Laptop Disk Image

including:

Collector

Time

Device

Hash

Storage

Transfer

Practical Exercise 3 — Windows Artifact Mapping

Map:

Process Execution

Persistence

User Login

Scheduled Task

Downloaded File

to potential Windows forensic artifacts.

Practical Exercise 4 — Persistence Investigation

Scenario:

Unknown Program
Runs Every
30 Minutes

Investigate:

Scheduled Tasks

Services

Registry

Process

File

Network

Practical Exercise 5 — Memory Investigation

Given a memory capture, identify the types of evidence you would look for related to:

Malware

C2

Credential Access

Process Injection

Practical Exercise 6 — Browser Forensics

Scenario:

A user reports clicking a phishing link.

Identify:

Browser History

Download History

Cookies

Cached Files

Endpoint Events

required to reconstruct activity.

Practical Exercise 7 — Cloud Forensics

Scenario:

A cloud administrator account was compromised.

Identify evidence for:

Authentication

API Calls

IAM Changes

New Keys

Logging Changes

Data Access

Practical Exercise 8 — Build a Forensic Timeline

Given:

08:41
Phishing Delivered

08:47
Browser Opens URL

08:51
Payload Downloaded

08:54
PowerShell Executes

08:55
C2 Connection

09:02
Scheduled Task

09:30
Credential Dumping

10:10
Remote Login

Build a narrative mapping the activity to likely attacker stages.

Practical Exercise 9 — Facts vs Hypotheses

Observation:

Archive File
Created
on Production Server

Write:

3 Supported Facts

3 Hypotheses

Evidence Needed
to Validate Each

Practical Exercise 10 — Forensic Report

Create a full:

Forensic_Report.md

for a fictional endpoint compromise.

Include:

Scope

Evidence

Timeline

Findings

IOCs

ATT&CK

Limitations

Conclusion

Knowledge Check

1. What is digital forensics?

2. What does DFIR mean?

3. How is digital forensics different from incident response?

4. What is volatile evidence?

5. What is non-volatile evidence?

6. What is order of volatility?

7. What is evidence preservation?

8. What is chain of custody?

9. Why are hashes used in forensics?

10. Why should investigators use working copies?

11. What is forensic acquisition?

12. What is live acquisition?

13. What is dead-box acquisition?

14. What is a disk image?

15. What is memory acquisition?

16. Why can system reboot destroy forensic evidence?

17. What is file metadata?

18. Why must file timestamps be interpreted carefully?

19. What is unallocated space?

20. What can Windows event logs reveal?

21. What is the forensic value of the Registry?

22. What is Prefetch?

23. Why does missing Prefetch not prove non-execution?

24. What is Shimcache?

25. What is Amcache?

26. What evidence can PowerShell logs provide?

27. Why are scheduled tasks important forensic artifacts?

28. Why are services important?

29. What Linux logs are valuable during investigations?

30. Why is shell history not always reliable?

31. What is memory forensics?

32. What can process analysis reveal?

33. What is process injection?

34. What can browser forensics reveal?

35. What can email headers reveal?

36. What is network forensics?

37. What is the difference between packet capture and flow data?

38. What can DNS logs reveal?

39. What can proxy logs reveal?

40. Why is cloud forensics different from endpoint forensics?

41. What cloud artifacts should be preserved?

42. Why are containers challenging for forensic analysis?

43. What is static malware analysis?

44. What is dynamic malware analysis?

45. Why must malware analysis use isolated environments?

46. What is a forensic timeline?

47. What is cross-source correlation?

48. Why should forensic investigators distinguish facts from hypotheses?

49. What are anti-forensics techniques?

50. Why must missing evidence be investigated?

51. What are forensic confidence levels?

52. Why should forensic reports document limitations?

53. Why should attribution be handled carefully?

54. How can forensic findings improve threat hunting?

55. How can forensic findings improve detection engineering?

Key Takeaways

Digital forensics follows:

Identify
      ↓
Preserve
      ↓
Collect
      ↓
Validate
      ↓
Examine
      ↓
Analyze
      ↓
Correlate
      ↓
Timeline
      ↓
Conclusion
      ↓
Report

Important evidence sources include:

Disk

Memory

Logs

Registry

Processes

Network

Browser

Cloud

Remember:

Artifact
      ≠
Conclusion

Timestamp
      ≠
Absolute Truth

Account Used
      ≠
Human Identity Proven

File Deleted
      ≠
Evidence Destroyed

IOC Found
      ≠
Complete Incident Story

A professional forensic analyst asks:

What Question
Am I Trying
to Answer?

      ↓

Which Evidence
Can Answer It?

      ↓

What Does
the Evidence
Actually Support?

Career Connection

Digital forensics skills are valuable for:

SOC Analysts

Senior SOC Analysts

Incident Responders

DFIR Analysts

Threat Hunters

Malware Analysts

Blue Team Analysts

Cyber Defense Analysts

During interviews, you should be able to explain:

How You Preserve
Evidence

Why Memory
May Be Collected First

How You Build
a Timeline

Which Windows
Artifacts You Review

How You Investigate
Persistence

How You Correlate
Multiple Evidence Sources

How You Separate
Facts from Hypotheses

The professional skill is not simply:

Finding
Interesting Artifacts

It is being able to reconstruct:

What Happened

When

How

Where

and

Which Evidence
Supports the Conclusion

What’s Next?

➡️ Next: 07 — Detection Engineering

You now understand how forensic evidence can reconstruct attacker activity after or during an incident.

The next step is to take those attacker behaviors and convert them into:

Reliable
Detections

In the next module, you will learn how to:

Design Detection Use Cases

Translate Threat Behavior
into Detection Logic

Write Detection Queries

Use Sigma

Build SIEM Rules

Map Detections
to MITRE ATT&CK

Tune Rules

Test Detections

Measure Coverage

Manage Detection Lifecycle

You will move from:

We Know
How the Attacker
Operated

to:

We Can
Detect This Behavior
Earlier
Next Time

➡️ Next: 07 — Detection Engineering