Results for “ftk-imager”

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.

Harden container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations.

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.