What problem does it solve? When responding to a security incident, analysts need a repeatable, evidence-preserving workflow to investigate memory dumps, disk images, network captures, and Windows host artifacts without contaminating the original evidence or missing critical indicators of compromise. ## Core Features & Use Cases - Evidence Preservation Workflow: Enforces hashing (SHA256), read-only copies, write protection of original media, and chain-of-custody notes before any analysis begins. - Memory Analysis: Guides Volatility 3 commands such as windows.info, windows.pslist, windows.netscan, and windows.cmdline to triage processes, network connections, and injected code from memory dumps. - Host Artifact & Timeline Triage: Covers Prefetch, Shimcache, Amcache, BAM, Event Logs, persistence mechanisms (Run keys, services, scheduled tasks, WMI), and super-timeline construction with Plaso or Timeline Explorer. - PCAP Investigation: Uses tshark for session and DNS statistics, exporting suspicious flows for protocol reverse engineering or malware C2 analysis. - Use Case: During an incident response engagement, an analyst receives a memory dump and PCAP from a compromised Windows host. The Skill walks them through hashing the evidence, listing processes and network connections with Volatility, checking persistence artifacts, and extracting IOCs for the threat-hunting team. ## Quick Start Use the digital-forensics skill to triage this memory dump and produce a timeline of suspicious processes and network connections.
