Incident Response & Digital Forensics

When to Activate

Active security incident: triage, scoping, evidence acquisition, containment, eradication
Memory forensics — process injection, rootkit (incl. eBPF), credential-theft, network artifacts
Windows event-log / artifact timelining and super-timeline reconstruction
Anti-forensics detection — timestomping, log clearing, secure deletion, VSS recovery
Cloud incident response — AWS/Azure/GCP identity-plane attacks and forensic collection
Ransomware / extortion response — hypervisor (ESXi) encryption, backup destruction, fast-dwell intrusions
Verifying suspect DFIR tooling used as adversary persistence (Velociraptor CVE-2025-6264)
Repository-compromise post-mortem — a poisoned public repo / force-pushed malicious commit / deleted PR (recover via dangling commits + GH Archive + Wayback + Events API; see references/repo-compromise-forensics.md)