Incident Response Forensics

Collect and analyze evidence without destroying it.

1. Preserve Before You Poke

• Take memory capture first (before heavy processes): WinPMem, LiME, or vendor snapshot
• Disk image via write-blocker or verified cloud snapshot; hash everything (SHA-256), record chain of custody
• Collect network evidence: firewall/flow logs, PCAP if available, proxy and DNS logs
• Never investigate on the live system beyond read-only collection — attacker tooling notices

2. Volatile Data Order

1. Network connections, routing tables
2. Running processes and services, loaded modules
3. Logged-in sessions, clipboard (if interactive)
4. Command histories, scheduled tasks, autostart

3. Artifact Analysis