Dfir Forensics

The problem

DFIR investigations are often chaotic, prone to procedural errors that ruin chain of custody, and slowed down by the manual correlation of disparate logs and artifacts.

What it does

• Standardizes evidence handling with hash verification and read-only analysis workflows.
• Guides parsing of Windows artifacts including evtx, registry, $MFT, and prefetch.
• Provides structured workflows for memory analysis using Volatility and cloud log review for AWS/Azure.
• Automates the normalization of timestamps to UTC and correlation of independent artifacts into a master timeline.
• Maps findings to MITRE ATT&CK tactics and techniques for formal reporting.

Frameworks & tools

Volatility, Velociraptor, KAPE, Autopsy, FTK, Sigma, and YARA.

Why this beats prompting it yourself

General AI often forgets the strict evidentiary requirements of forensic work, such as chain of custody or timestamp normalization. This skill enforces a structured lifecycle and prevents common mistakes like analyzing original evidence or making claims without dual-source corroboration.

Use cases

• Investigating a suspected Windows workstation compromise via KAPE and $MFT analysis.
• Performing memory forensics on a dump to identify shellcode injection or lateral movement.
• Auditing AWS CloudTrail and Entra ID logs following a credential harvesting alert.
• Compiling a court-ready forensic report with timestamped evidence citations.

Known limitations

Requires authorized access to target systems and assumes the analyst has standard forensic tooling installed locally.