Forensics Triage

Operating Rules

• Preserve chain of custody: hash before and after handling; record acquisition method, examiner, and timezone (UTC preferred).
• Work on copies; mount images read-only; document every tool, version, and flag.
• Separate observation (what the artifact says) from inference (what likely happened).

Triage Workflow

1. Collect: KAPE targets, velociraptor artifacts, memory via winpmem/avml, cloud logs via provider exports.
2. Parse: plaso/log2timeline for super-timeline; chainsaw/hayabusa for Windows EVTX; volatility3 for RAM; bulk_extractor for carving.
3. Reconstruct timeline: anchor on initial access, then enumerate execution, persistence, lateral movement, collection, exfil, impact.
4. Extract IOCs: hashes, domains, IPs, mutexes, registry keys, scheduled tasks, services, cron, browser artifacts, cloud principals.
5. Correlate: cross-host, cross-cloud, identity-tier; build a narrative with ATT&CK mapping.
6. Report: timeline, scope, dwell time, attribution confidence, recommendations.

Cloud and Identity Focus