Skip to content

Digital Forensics and Incident Response

DFIR is finding out what the fuck happened
When a breach occurs you need to determine the scope of compromise, identify the entry point, contain the threat, and gather evidence for potential legal action

The DFIR Process

  1. Identification - Detect the incident (alerts , user reports , anomalies)
  2. Containment - Stop the bleeding (disconnect , isolate , block)
  3. Eradication - Remove the threat (malware , backdoors , persistence)
  4. Recovery - Restore normal operations (clean backups , verify)
  5. Lessons Learned - Improve defenses (post-mortem , recommendations)

Order of Volatility

When collecting evidence you must collect the most volatile data first because it disappears fastest:

  1. CPU registers and cache - Gone on reboot
  2. Routing table and ARP cache - Lost on reboot
  3. Process table - Lost on shutdown
  4. Kernel memory - Lost on shutdown
  5. Temporary filesystem - /tmp contents may be cleared
  6. Disk - Persistent (primary long-term evidence)
  7. Remote logs - May be overwritten by attacker
  8. Physical configuration - Network topology diagrams
  9. Archives - Backups from before the incident

The Forensics Mindset

  • Document everything (chain of custody)
  • Never work on original evidence (always image then work on copy)
  • Write-block any storage device before imaging
  • Hash everything and verify hashes
  • Timeline analysis reveals correlations

Common Incident Types

  • Ransomware - Encrypted files , ransom note , lateral movement
  • Phishing - Email logs , browser history , downloaded payloads
  • Insider Threat - Unusual access patterns , data exfiltration
  • Web Compromise - Web server logs , modified files , backdoor scripts
  • Supply Chain - Compromised software updates , DLL hijacking

Evidence Types

  • Volatile - RAM, network connections, running processes
  • Non-volatile - Hard drives, SSDs, removable media
  • Network - PCAP files, firewall logs, proxy logs, DNS logs
  • Application - Web server logs, database logs, application logs
  • Remote - SIEM data, cloud logs, centralized logging