My notes on digital forensics and incident response, from how a disk stores data through evidence acquisition, disk and file-system analysis, Windows, Linux and macOS artifacts, memory, network, timelines and reporting. Each lesson pairs the theory with a tool demo and a lab you can run yourself.

Everything here is for learning, CTFs and investigations on systems you are authorized to examine. Work on images and copies, and keep the chain of custody.

Forensics · Intro to Forensics

#	Lesson
0.1	What Digital Forensics Is
0.2	Law, Ethics and Chain of Custody
0.3	Building a Forensics Lab
0.4	The Standard Investigation Process

Forensics · Storage Foundations

#	Lesson
1.1	Hex, endianness and magic bytes
1.2	Sectors, clusters, LBA and slack space
1.3	MBR and GPT partition tables
1.4	FAT and exFAT file systems
1.5	NTFS and the MFT
1.6	ext4, APFS and HFS+ for forensics
1.7	Hashing and evidence integrity

Forensics · Evidence Acquisition

#	Lesson
2.1	Order of volatility, live and dead acquisition
2.2	Creating a forensic disk image
2.3	Acquiring RAM on Windows and Linux
2.4	Fast triage at the scene

Forensics · Disk Forensics

#	Lesson
3.1	The Sleuth Kit and Autopsy
3.2	File carving when metadata is gone
3.3	Recovering deleted files on NTFS and FAT
3.4	Analyzing hidden data

Forensics · Windows Forensics

#	Lesson
4.1	Registry Forensics and the Windows Hives
4.2	Event Log Forensics with evtx Files
4.3	Program Execution and Proving a Program Ran
4.4	File and Folder Access Artifacts
4.5	Windows Persistence and Where Malware Hides
4.6	Volume Shadow Copy and Recovering Old Files

Forensics · Linux and macOS

#	Lesson
5.1	Linux artifacts after an SSH brute force
5.2	macOS artifacts behind a suspicious auto-start app

Forensics · Memory Forensics

#	Lesson
6.1	Memory forensics and Volatility 3 from scratch
6.2	Processes, DLLs, network, and hidden processes
6.3	Detecting code injection, process hollowing, and rootkits in RAM
6.4	Extracting credentials and fileless PowerShell payloads from RAM

Forensics · Network Forensics

#	Lesson
7.1	Reading pcap with Wireshark, filters, and object export
7.2	Traffic analysis with Zeek and NetworkMiner
7.3	Detecting C2, DNS tunneling, and exfiltration

Forensics · Browser, Email, Mobile

#	Lesson
8.1	Browser forensics and reconstructing web activity
8.2	Email forensics and tracing the sender
8.3	Mobile forensics with Android and iOS backups

Forensics · Timeline and IR

#	Lesson
9.1	Super Timelines with plaso and Timesketch
9.2	Reconstructing the Attack Chain with MITRE ATT&CK
9.3	IOCs and YARA for Bulk Artifact Scanning

Forensics · Anti-Forensics

#	Lesson
10.1	Timestomp, Wiping and Log Clearing Detection
10.2	Full Disk Encryption and Investigation Strategy

Forensics · Hands-on

#	Lesson
11.1	Solving CTF forensics challenges
11.2	Investigating a malware infected image end to end
11.3	Writing a standard forensics report