Forensic technique

Goal: produce defensible, reproducible findings from heterogeneous evidence.

When this technique applies

• Potential compromise requiring reconstruction of user/system activity.
• Evidence includes disk images, ISO media, RAM dumps, PCAP, endpoint logs, or SaaS audit records.
• Need to correlate endpoint, filesystem, and network timelines.
• Need report-ready output for incident response, legal, or internal review.

Boundary with offensive-tools

This skill explains methodology and decision flow. Tool-specific syntax belongs to offensive-tools/* skills.

Initial triage

Before extracting deeply, classify the evidence mix and decide what source can answer the objective fastest with the least interpretive risk.