Forensic Analysis Basics

Forensic analysis determines what happened, how it happened, and who is behind it. The key is preserving evidence integrity.

Chain of custody¶

1. Document the finding (time, location, who)
2. Hash evidence before analysis (SHA-256)
3. Work on a copy, never on the original
4. Record every step
5. Store evidence securely

Key Tools¶

Disk image¶

dd if=/dev/sda of=disk.img bs=4M status=progress sha256sum disk.img > disk.img.sha256

Memory dump¶

sudo avml memory.dmp

Volatility — memory analysis¶

vol3 -f memory.dmp windows.pslist vol3 -f memory.dmp windows.netscan

Log analysis¶

grep -r “Failed password” /var/log/auth.log | sort | uniq -c | sort -rn

Linux forensics¶

Timeline¶

find / -newer /tmp/reference_time -print 2>/dev/null

Persistence¶

crontab -l ls -la /etc/cron.d/ systemctl list-unit-files –state=enabled

Network¶

ss -tulpn iptables -L -n

Key Takeaway¶

Hash evidence, work on a copy, document everything. Volatility for memory, dd for disks.