DFIR Workflow
Scope
Defensive investigation on systems/data you are authorized to examine.
Canonical tools (catalog)
| Need | Tool | Catalog section |
|---|---|---|
| Memory | Volatility3 | dfir |
| Endpoint | Velociraptor | dfir |
| Timeline | Plaso / Timesketch | dfir |
| Disk | Autopsy / Sleuth Kit | dfir |
Local URLs: E:\Code\skills\catalog\sources.yaml
Flow
- Preserve evidence (hash, read-only)
- Triage: what, when, which hosts
- Memory and/or disk analysis with official tools
- Timeline + IOCs
- Report: facts first, confidence levels
Related
security-workflowsystematic-debuggingfor tooling failuresverification-before-completionbefore closing incident