Deep forensic artifact analysis

When it applies

Triage (defense-dfir-triage) has scoped the incident and you now hold preserved evidence — a memory dump, a disk image (E01/raw), a PCAP, or exported host artifacts — and must prove, artifact by artifact, what the attacker did: which process ran, what persisted, what left the network. This is deep analysis of dead-box/dead-disk evidence, not live first response.

Why it works

Attackers can delete logs, but memory, filesystem metadata ($MFT, USN journal), and packet captures retain artifacts the attacker never controlled. Parsing them with purpose-built tools reconstructs execution, persistence, and exfiltration even after the live system was cleaned — and hashing plus chain of custody makes the conclusions defensible.