<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: digital-forensics
description: >-
  Digital forensics including disk imaging (dd/FTK/E01), memory forensics (Volatility 3),
  timeline analysis (plaso/log2timeline), evidence preservation and chain of custody,
  Windows/Linux/macOS artifact analysis, browser forensics, email forensics, mobile
  forensics, anti-forensics detection, and expert witness reporting.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - forensics
  - dfir
  - volatility
  - disk-imaging
  - timeline-analysis
  - memory-forensics
  - evidence-collection
  - chain-of-custody
  - artifact-analysis
  - anti-forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1070", "T1027", "T1036", "T1564"]
  nist-csf: ["RS.AN-1", "RS.AN-3", "RS.AN-4"]
  frameworks: ["NIST SP 800-86", "RFC 3227", "ACPO Good Practice Guide"]
---

# Digital Forensics

## When to Use

Activate when the operator asks about disk forensics, memory analysis, evidence
collection, chain of custody, timeline reconstruction, artifact analysis,
Volatility, or forensic reporting.

Mode: `[MODE: INCIDENT]` for active investigations; `[MODE: BLUE]` for proactive forensic readiness.

## Quick Reference

| Task | Tool / Command | Evidence Type |
|------|---------------|---------------|
| Disk image | `dc3dd if=/dev/sda of=image.dd hash=sha256 log=hash.log` | Disk |
| Memory dump | `avml /tmp/memory.lime` (Linux) / `winpmem.exe mem.raw` (Windows) | Memory |
| Volatility pslist | `vol3 -f mem.raw windows.pslist` | Memory |
| Volatility netscan | `vol3 -f mem.raw windows.netscan` | Memory |
| Timeline | `log2timeline.py plaso.dump image.dd` → `psort.py -o l2tcsv plaso.dump` | Timeline |
| Registry hive | `regripper -r SAM -f sam` | Windows |
| Browser history | `hindsight -i "AppData/Local/Google/Chrome/User Data/Default"` | Browser |
| File carving | `foremost -i image.dd -o carved/` | Disk |
| Hash verify | `sha256sum image.dd && cat hash.log` | Integrity |
| Mount image | `mount -o ro,loop,offset=$((512*2048)) image.dd /mnt/evidence` | Analysis |

## Workflow

### 1. Evidence Preservation (Order of Volatility — RFC 3227)

```
Collection order (most to least volatile):
1. CPU registers and cache
2. RAM (memory dump)
3. Network connections and routing tables
4. Running processes
5. Disk (forensic image)
6. Remote logging and monitoring data
7. Physical configuration and network topology
8. Archival media (backups, removable media)

Chain of custody:
├── Document who collected, when, where, how
├── Hash everything immediately after collection
├── Store originals in tamper-evident bags
├── Work only on forensic copies (never originals)
├── Log every access to evidence
└── Maintain unbroken chain from collection to court
```

### 2. Memory Forensics (Volatility 3)

```bash
# Linux memory acquisition
sudo avml /tmp/memory.lime
# OR
sudo insmod lime-$(uname -r).ko "path=/tmp/memory.lime format=lime"

# Windows memory acquisition
winpmem_mini_x64.exe memory.raw

# Volatility 3 analysis
vol3 -f memory.raw windows.info        # OS information
vol3 -f memory.raw windows.pslist      # Process listing
vol3 -f memory.raw windows.pstree      # Process tree
vol3 -f memory.raw windows.netscan     # Network connections
vol3 -f memory.raw windows.cmdline     # Command lines
vol3 -f memory.raw windows.malfind     # Injected code detection
vol3 -f memory.raw windows.handles     # Open handles
vol3 -f memory.raw windows.dlllist     # Loaded DLLs
vol3 -f memory.raw windows.filescan    # File objects in memory
vol3 -f memory.raw windows.dumpfiles --pid $PID  # Dump process files
vol3 -f memory.raw windows.hashdump    # Password hashes

# Linux memory analysis
vol3 -f memory.lime linux.pslist
vol3 -f memory.lime linux.bash         # Bash history from memory
vol3 -f memory.lime linux.check_syscall  # Rootkit detection
vol3 -f memory.lime linux.mount        # Mounted filesystems
```

### 3. Disk Forensics

```bash
# Forensic imaging with hash verification
dc3dd if=/dev/sda of=evidence.dd hash=sha256 hash=md5 log=imaging.log

# E01 format (compressed, with metadata)
ewfacquire /dev/sda -t evidence -c deflate -S 2G

# Mount forensic image (read-only)
OFFSET=$(mmls evidence.dd | grep "NTFS" | awk '{print $3}')
mount -o ro,loop,noexec,offset=$((512*$OFFSET)) evidence.dd /mnt/evidence

# Windows artifact locations:
# Registry hives: C:\Windows\System32\config\{SAM,SYSTEM,SECURITY,SOFTWARE}
# Event logs: C:\Windows\System32\winevt\Logs\
# Prefetch: C:\Windows\Prefetch\
# Amcache: C:\Windows\AppCompat\Programs\Amcache.hve
# MFT: $MFT (Master File Table)
# USN Journal: $UsnJrnl:$J
# SRUM: C:\Windows\System32\sru\SRUDB.dat
# Shellbags: NTUSER.DAT (HKCU\Software\Microsoft\Windows\Shell\BagMRU)

# Linux artifact locations:
# Auth logs: /var/log/auth.log or /var/log/secure
# System logs: /var/log/syslog or journalctl
# Bash history: ~/.bash_history
# SSH keys: ~/.ssh/
# Cron jobs: /var/spool/cron/ and /etc/cron.d/
# Login records: /var/log/wtmp, /var/log/btmp, /var/run/utmp
```

### 4. Timeline Analysis

```bash
# Generate super-timeline with plaso
log2timeline.py --storage-file timeline.plaso evidence.dd

# Parse and filter timeline
psort.py -o l2tcsv timeline.plaso "date > '2026-03-01' AND date < '2026-03-17'" > filtered.csv

# Create targeted timeline with mactime
fls -r -m "/" evidence.dd > bodyfile.txt
mactime -b bodyfile.txt -d 2026-03-01..2026-03-17 > timeline.csv

# Key time-based artifacts:
# $MFT timestamps: Created, Modified, Accessed, Entry Modified (MACE)
# $UsnJrnl: Real-time file system change journal
# Prefetch: Application execution timestamps
# Event logs: Precise event timestamps
# Browser history: URL visit timestamps
# Registry: Last write timestamps on keys
```

### 5. Anti-Forensics Detection

```
Common anti-forensics techniques and detection:
├── Timestomping: $MFT MACE timestamps don't match $STDINFO
│   Detection: Compare $FN timestamps with $SI timestamps
├── Log clearing: Event Log service stop (EID 1102/104)
│   Detection: Gaps in sequential Event IDs
├── Secure deletion: Overwritten sectors
│   Detection: File carving may recover partial data
├── Steganography: Data hidden in images/audio
│   Detection: stegdetect, statistical analysis
├── Encryption: BitLocker/VeraCrypt volumes
│   Detection: Identify encrypted volumes, seek keys in memory
└── Rootkits: Hidden processes/files/connections
    Detection: Cross-reference live system vs forensic image
```

## Verification

- [ ] Evidence collected in order of volatility
- [ ] Chain of custody documented for all evidence
- [ ] Forensic images verified (hash match on source and copy)
- [ ] Memory dump analyzed (processes, network, injected code)
- [ ] Timeline reconstructed with key events identified
- [ ] Anti-forensics artifacts detected and documented
- [ ] Forensic report suitable for legal proceedings
