Module 9: Digital Forensics

Recover evidence. Reconstruct the attack. Build the timeline.

6 lessons · 6 labs

VelociraptorVolatility 3
Operation APT Breach

Reconstruct the attacker's timeline on WS-HR-01 from Prefetch, Amcache, and registry artifacts.

Path

  1. 01
    Lesson

    Evidence Handling & Chain of Custody

    Order of volatility, evidence preservation, chain of custody documentation, legal considerations

  2. 02
    Lab

    Lab 9.1 — Evidence Collection

    Document chain of custody for a simulated incident. Collect volatile data in the correct order using Velociraptor.

  3. 03
    Lesson

    Disk Imaging & Acquisition

    Disk imaging concepts, FTK Imager, dcfldd, write blockers, triage imaging with KAPE

  4. 04
    Lab

    Lab 9.2 — Disk Artifact Analysis

    Analyze a forensic image: extract Prefetch, Amcache, and ShimCache entries. Determine what programs were executed and when.

  5. 05
    Lesson

    Windows Forensic Artifacts

    Prefetch, Amcache, ShimCache, UserAssist, Shellbags, Jump Lists, browser artifacts

  6. 06
    Lab

    Lab 9.3 — Windows Forensic Investigation

    Full Windows investigation: registry analysis, user activity timeline, USB history, browser artifacts. Build the attack narrative.

  7. 07
    Lesson

    Linux Forensic Artifacts

    auth.log, wtmp/btmp, bash_history, /var/log, package logs, cron artifacts, /tmp analysis

  8. 08
    Lab

    Lab 9.4 — Linux Forensic Investigation

    Investigate a compromised Linux server: analyze auth.log, bash_history, cron jobs, and /tmp for attacker artifacts.

  9. 09
    Lesson

    Memory Forensics with Volatility 3

    Memory acquisition, Volatility 3 plugins, process analysis, network artifacts, detecting injected code

  10. 10
    Lab

    Lab 9.5 — Memory Forensics

    Analyze a memory dump with Volatility 3: list processes, detect injected code, extract network connections, find persistence.

  11. 11
    Lesson

    Building a Forensic Timeline

    Super timelines, correlating artifacts across sources, Plaso/log2timeline concepts, presenting findings

  12. 12
    Lab

    Lab 9.6 — Build the Timeline

    Combine disk, memory, and log artifacts into a unified forensic timeline. Present a minute-by-minute reconstruction of the attack.