# Forensic Technique

> Incident forensics: preservation, triage, timelines, artifact correlation, reporting across disk (E01/DD/RAW), memory, PCAP.

- Skill: `aeondave/forensic-technique` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add aeondave/forensic-technique`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/forensic-technique/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/forensic-technique

---


# Forensic technique

Goal: produce **defensible, reproducible findings** from heterogeneous evidence.

## When this technique applies

- Potential compromise requiring reconstruction of user/system activity.
- Evidence includes one or more of: disk image, ISO media, RAM dump, PCAP.
- Need to correlate endpoint, filesystem, and network timelines.
- Need report-ready output for incident response, legal, or internal review.

## Boundary with offensive-tools

This skill explains **methodology and decision flow**.
Tool-specific syntax belongs to `offensive-tools/*` skills.

## Initial triage

Before extracting deeply, classify the evidence mix and decide what source can answer the objective fastest with the least interpretive risk.

- **Starting state**: is the case driven by disk, memory, PCAP, ISO/media, logs, or a mixed evidence set?
- **First questions**: what is the investigation objective, which artifacts are most volatile or most probative, and what timeline window and provenance constraints apply?
- **Immediate actions**: verify integrity, normalize time and scope, then inspect the highest-value source first instead of carving everything.
- **Tool-family direction**: use forensic acquisition/timeline families (`sleuth-kit`, `autopsy`, `ftk-imager`) for disk/media, `volatility3` for memory, and `zeek`/`tcpdump`/`wireshark` for network evidence; use `yara` and `capa` only after suspicious artifacts are isolated.
- **Escalation rule**: require corroboration across sources before claiming compromise, execution, persistence, or exfiltration.

## Agent operating model

The agent should keep this loop:

1. Preserve and scope evidence.
2. Prioritize by volatility and investigative value.
3. Examine source-specific artifacts.
4. Correlate across sources into one timeline.
5. Validate claims with independent corroboration.
6. Report facts, interpretation boundaries, and recommendations.

Do not move to deep extraction/carving before timeline framing and hypothesis definition.

## Core forensic model

1. **Preserve**: isolate evidence, hash, and record provenance needed for reproducibility.
2. **Collect**: acquire additional required artifacts with minimal alteration.
3. **Examine**: parse artifacts by source type (disk, memory, network).
4. **Correlate**: build a unified timeline across sources.
5. **Conclude**: state what is supported by evidence vs assumptions.
6. **Report**: produce concise, reproducible findings and follow-up actions.

## Evidence-first prioritization

Use volatility and value to decide acquisition/examination order.

1. Live volatile artifacts (RAM, active connections, running processes)
2. Network evidence at risk of rotation (live captures, ephemeral logs)
3. Endpoint high-value non-volatile artifacts (event logs, browser data, registry)
4. Full disk image deep examination
5. Enrichment sources (threat intel, external context)

## Objective-driven workflows

### 1. Disk image investigation (E01/DD/RAW)

Use when you need file-system artifacts, deleted-content recovery, execution traces, and persistence evidence.

- Start with integrity + partition mapping.
- Enumerate file systems and prioritize user/profile, startup, logs, scheduled tasks, shell history.
- On Windows evidence, prioritize execution artifacts such as Prefetch, LNK, Jump Lists, AmCache, ShimCache, SRUM, PowerShell logs, services, and scheduled tasks.
- Build an initial timeline before deep carving.
- Recover/decode only artifacts linked to hypotheses (do not carve everything by default).
- Validate notable findings in at least one secondary source (e.g., link file + event log + registry).

Primary tool families:
- `offensive-tools/forensic/sleuth-kit/`
- `offensive-tools/forensic/autopsy/`
- `offensive-tools/forensic/ftk-imager/`
- `offensive-tools/forensic/yara/`
- `offensive-tools/forensic/capa/` — capability detection on extracted executables (identifies malware families, TTPs, embedded shellcode)

### 2. ISO media investigation

Use when the evidence is installer-like media, archives, or mounted image content.

- Verify hash and mount read-only.
- Inventory executable/script content and autorun-related metadata.
- Extract Office/PDF/archive payload chains, embedded objects, external template references, shortcut chains, and script launchers before any dynamic handling.
- Compare bundle contents against expected vendor structure and signatures.
- Extract suspicious binaries/configs for static triage and rule scanning.
- Correlate ISO-delivered artifacts with host execution traces from endpoint evidence.

Primary tool families:
- `offensive-tools/forensic/sleuth-kit/`
- `offensive-tools/rev/binwalk/`
- `offensive-tools/forensic/yara/`

### 3. PCAP/network forensics

Use when reconstructing communication, exfiltration paths, C2 patterns, or lateral movement.

- Build traffic summary first (top talkers, protocols, unusual destinations).
- Pivot by DNS, TLS metadata, HTTP objects, and transfer channels.
- Identify sequencing: initial access indicators, staging, beaconing, bulk transfer.
- Tie network sessions to endpoint process/user context when possible.

Primary tool families:
- `offensive-tools/forensic/zeek/`
- `offensive-tools/forensic/tcpdump/`
- `offensive-tools/network/wireshark/`

### 4. Memory-centered investigation

Use when malware is fileless/injected, or when disk evidence is incomplete.

- Enumerate processes/parents, command lines, sockets, loaded modules.
- Hunt for injected regions and anomalous memory protections.
- Extract process artifacts and correlate with on-disk binaries and PCAP events.
- Treat memory findings as high-confidence for “what was running now,” then confirm persistence on disk.

Primary tool families:
- `offensive-tools/forensic/volatility3/`
- `offensive-tools/forensic/yara/`
- `offensive-tools/forensic/capa/` — classify extracted process dumps or unpacked binaries against malware capability ruleset

### 5. Mixed-source incident reconstruction

Use when you have disk + PCAP + memory and need a single chronology.

- Create source-local timelines first.
- Normalize to a single timezone and clock offset model.
- Merge into one chronology with confidence tags:
  - Direct evidence (observed in source)
  - Corroborated evidence (confirmed by second source)
  - Inference (plausible but unconfirmed)
- Explicitly record competing explanations for ambiguous events.

### 6. Log-centric and objective-driven investigations

Use when evidence is mostly EVTX, registry hives, MFT snapshots, API trace logs, or objective-driven forensic tasks.

- Build an objective-to-artifact map first (which artifact can answer each objective decisively).
- Prefer deterministic extraction over broad hunting (exact key, exact event id, exact stream, exact record).
- For Windows log-heavy cases, prioritize: PowerShell ScriptBlock (4104), process creation (4688/Sysmon 1), service/task creation, Defender/AV alerts, and relevant registry keys. When an ETW trace (`.etl`) is provided, treat provider name + event id as the primary pointer (e.g. `Microsoft-Windows-PowerShell`, `Microsoft-Antimalware-Scan-Interface`, `Microsoft-Windows-Kernel-Process`).
- For Linux hosts, prioritize `journalctl` output from `/var/log/journal/*` (auth, sshd, sudo, systemd unit start/stop) and `/var/log/audit/audit.log` (auditd) for structured process/command evidence.
- For macOS hosts, use the Unified Log system (`log collect`, `log show --predicate ...`, or an `.logarchive` bundle) for process, network, and security signals; classic `/var/log` text logs are largely deprecated.
- For API trace cases, reconstruct sequence by API dependency chain (enumeration → allocation/write → execution).
- Mark each conclusion as: direct artifact fact vs inferred interpretation.

Primary tool families:
- `offensive-tools/forensic/chainsaw/` — fast triage across EVTX, `$MFT`, ShimCache, SRUM, and registry hives with Sigma and built-in detection rules; produces multi-source execution timelines

## Practical quality gates

- Provenance and hash records exist for all primary evidence.
- At least one key claim is corroborated across two independent sources.
- Timeline includes both malicious and benign context to avoid narrative bias.
- Every IOC or behavioral claim has exact source pointer (artifact + timestamp).
- Report distinguishes fact, interpretation, and recommendation.

## Anti-patterns

- Starting with deep carving before timeline and hypothesis framing.
- Treating one artifact as conclusive without corroboration.
- Mixing local-time and UTC evidence without explicit normalization.
- Writing conclusion-first reports and backfilling evidence.

## Required deliverables from the agent

1. Evidence inventory with integrity state.
2. Source-specific findings with exact pointers.
3. Correlated timeline with confidence labels.
4. High-confidence claims vs inference boundary.
5. Report-ready conclusions and next actions.

## Resources

- [references/evidence-preservation.md](references/evidence-preservation.md) — Load for provenance, hashing, read-only workflow, and evidence-handling order.
- [references/disk-and-iso-analysis.md](references/disk-and-iso-analysis.md) — Load for filesystem/media triage, startup paths, selective extraction, and validation.
- [references/windows-execution-indicators.md](references/windows-execution-indicators.md) — Load for Prefetch, LNK, Jump Lists, AmCache, ShimCache, SRUM, and related execution artifacts.
- [references/document-malware-analysis.md](references/document-malware-analysis.md) — Load for Office, PDF, archive, embedded-object, and external-template payload chains.
- [references/pcap-analysis.md](references/pcap-analysis.md) — Load for protocol triage, session reconstruction, transfer paths, and network chronology.
- [references/memory-analysis.md](references/memory-analysis.md) — Load for process/module/socket triage, injected regions, transient secrets, and disk/network correlation.
- [references/timeline-correlation.md](references/timeline-correlation.md) — Load for clock normalization and merging source-local timelines with confidence labels.
- [references/lessons-learned-patterns.md](references/lessons-learned-patterns.md) — Load for mixed-artifact heuristics and fast-answer investigation patterns.
- [scripts/forensic_triage.py](scripts/forensic_triage.py) — Run to classify an evidence file and get the first forensic workflow/tool-family recommendation.