Dfir Workflow

Use for digital forensics / incident response workflows — memory, disk, timeline. Defensive investigation. Prefer Volatility3, Velociraptor, Plaso, Autopsy from catalog URLs.

tomjiu Updated

File contents

DFIR Workflow

Scope

Defensive investigation on systems/data you are authorized to examine.

Canonical tools (catalog)

Need Tool Catalog section
Memory Volatility3 dfir
Endpoint Velociraptor dfir
Timeline Plaso / Timesketch dfir
Disk Autopsy / Sleuth Kit dfir

Local URLs: E:\Code\skills\catalog\sources.yaml

Flow

  1. Preserve evidence (hash, read-only)
  2. Triage: what, when, which hosts
  3. Memory and/or disk analysis with official tools
  4. Timeline + IOCs
  5. Report: facts first, confidence levels

Related

  • security-workflow
  • systematic-debugging for tooling failures
  • verification-before-completion before closing incident

tomjiu/agent-skills-mcp/tree/main/selected/dfir-workflow commit 769accb239

Frequently asked questions

npx skillmds@latest add tomjiu/dfir-workflow