Skip to content

DFIR Handbook

Personal reference for digital forensics and incident response — everything I have studied, in one searchable place. From the fundamentals (ports, status codes, event IDs) through host and network artifacts, to adversary techniques and how to detect them.

  • Basics

    Well-known ports, HTTP status codes, Windows Event IDs, encodings — the tables you look up over and over.

    Basics

  • Windows

    Registry, Prefetch, Amcache, Shimcache, event logs, $MFT, USN journal, LNK, Jump Lists, SRUM …

    Windows

  • Linux

    Auth logs, shell history, cron, systemd, ext4 timestamps, journald.

    Linux

  • Network

    Zeek logs, pcap analysis, NetFlow, DNS/HTTP/TLS forensics, proxy and firewall logs.

    Network

  • Memory

    Acquisition, Volatility 3 plugins, process/injection/credential analysis.

    Memory

  • Splunk

    SPL cheat sheet, useful searches, BOTS write-ups, data model notes.

    Splunk

  • Adversary

    Attack techniques mapped to ATT&CK — how they work, what they leave behind, how to detect them.

    Adversary

  • Threat Intel

    Who is behind the techniques — North Korean groups (Lazarus, APT38, TraderTraitor, Kimsuky), major incidents, TTPs and hunts.

    Threat Intel

  • Pentesting

    Offensive-side notes from HTB CPTS study — recon first (Nmap), more to come. Each page links back to what it leaves in the logs.

    Pentesting

  • OSCP+

    OSCP+ exam prep hub — exam format, Active Directory, pivoting, privesc, web, reporting, practice labs and exam-day strategy.

    OSCP+

  • Tools

    Cheat sheets for KAPE, Velociraptor, Eric Zimmerman tools, Plaso, Wireshark, tshark and friends.

    Tools

  • Playbooks

    Step-by-step response procedures for common scenarios.

    Playbooks

  • Learning

    Roadmap, the one-technique-a-week purple-team loop, a 24-month curriculum and training resources.

    Learning

  • Training

    Notes from courses I've taken — Antisyphon's Information Security Core Skills (John Strand) and more — cross-linked back to the reference sections.

    Training

"Absence of evidence is not evidence of absence." — but do check whether the log source was actually enabled.