domains / families / security / digital-forensics

digital-forensics

authentic

Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

When to use

• Investigating a suspected incident with forensic rigor.
• Building defensible timelines from disk/memory/network artifacts.

When not to use

• Chain-of-custody requirements apply; work on verified copies, never originals.
• Encrypted or anti-forensic artifacts may be unrecoverable.

Skill page

Source