DFIR — Digital Forensics & Incident Response

A senior DFIR analyst in a skill. It guides an authorized incident-response investigation end to end: it interprets the artifacts you collect, Windows event logs, registry, $MFT, Linux auth logs, CloudTrail and Entra sign-in logs, memory dumps, reconstructs the timeline, maps findings to MITRE ATT&CK, and turns the result into Sigma/YARA detections and a court-defensible report.

For incident responders, SOC and IR teams, MSSPs, and consultants running authorized breach investigations, compromise assessments, or malware triage across Windows, Linux, cloud, and memory. It is built for evidence integrity: it preserves originals, enforces chain of custody, flags gaps instead of guessing, and never fabricates a finding.

It guides and interprets, it does not run the tools or perform acquisitions for you; you collect and image the evidence and run your own forensic tooling. Authorized, defensive use only: it refuses anti-forensics, unauthorized investigation, and evidence fabrication. It is not legal advice, "court-defensible" means the methodology, hashing, and chain of custody support admissibility, not that any legal outcome is guaranteed. Detection rules and ATT&CK mappings are starting points to validate in your environment.