Offensive security assessments
Digital Forensics Fundamentals
Digital forensics (DFIR) is the practice of acquiring, preserving, and analysing
Why it matters
Digital forensics (DFIR) is the practice of acquiring, preserving, and analysing digital evidence in a way that is accurate and defensible. Whether you are responding to an incident or supporting an investigation, the same core principles apply.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Preserve first, analyse later. Work on copies, never the original evidence.
- Maintain integrity. Hash evidence (e.g. SHA-256) at acquisition and verify it has
- Document everything. Who did what, when, and with which tool, the chain of
- When collecting evidence, capture the most volatile data first, because it disappears soonest: 1
- CPU registers and cache 2
- RAM (running processes, network connections, encryption keys) 3
- Network state (active connections, ARP cache, routing tables) 4
- Windows: Event logs, registry hives, $MFT, prefetch, shimcache, amcache.
What we look for
- Preserve first, analyse later. Work on copies, never the original evidence.
- Maintain integrity. Hash evidence (e.g. SHA-256) at acquisition and verify it has
- Document everything. Who did what, when, and with which tool, the chain of
- When collecting evidence, capture the most volatile data first, because it disappears soonest: 1
- CPU registers and cache 2
- RAM (running processes, network connections, encryption keys) 3
- Network state (active connections, ARP cache, routing tables) 4
- Windows: Event logs, registry hives, $MFT, prefetch, shimcache, amcache.