domains / families / security / performing-disk-forensics-investigation

performing-disk-forensics-investigation

separate

'Conduct disk forensics investigations using forensic imaging, file system

When to use

• A security incident requires forensic analysis of a system's persistent storage
• Evidence preservation is needed for potential legal proceedings or HR investigations
• Deleted files, browser history, or application artifacts must be recovered
• A timeline of user or adversary activity must be reconstructed from file system metadata
• Malware persistence mechanisms stored on disk need identification and documentation

When not to use

• volatile evidence (running processes, network connections)

Skill page

Source