Tools¶

The DFIR toolbox — what each tool is for, the commands that matter, and how they fit together. The chain is almost always acquire → collect → parse → timeline → review, and these pages cover each stage.

The pipeline¶

flowchart LR
    A[Acquire<br/>image RAM + disk] --> C[Collect<br/>triage artifacts]
    C --> P[Parse<br/>artifact → CSV/JSON]
    P --> T[Timeline<br/>combine chronologically]
    T --> R[Review<br/>Timeline Explorer / Timesketch]
    A -. imaging-collection .-> A
    C -. KAPE · Velociraptor .-> C
    P -. Zimmerman tools .-> P
    T -. Plaso .-> T

By stage¶

Stage	Tool	Page
Acquire a defensible image (RAM + disk)	WinPmem, FTK Imager, dd/dc3dd, Guymager, AVML	Imaging & collection
Collect triage artifacts from one host	KAPE (Targets)	KAPE
Collect / hunt across the fleet, live	Velociraptor	Velociraptor
Parse artifacts to CSV	Eric Zimmerman suite (+ KAPE `!EZParser`)	Zimmerman tools
Timeline everything at once	Plaso / log2timeline, Timesketch	Plaso & timelines
Review	Timeline Explorer	Zimmerman tools
Hunt in EVTX with Sigma	Chainsaw, Hayabusa	Event logs

Which collector when?¶

Situation	Use
One live/mounted Windows box, fast triage	KAPE `!SANS_Triage`
Many endpoints, ask one question of all	Velociraptor hunt
Air-gapped / no server	Velociraptor offline collector or KAPE to USB
Need unallocated space, carving, court image	Full disk image (E01)
Volatile data / encrypted disk unlocked	RAM image first, then Memory forensics

Pages¶

Imaging & collection — order of volatility, RAM/disk imaging, E01 vs raw, write-blocking & hashing
KAPE — Targets & Modules, !SANS_Triage + !EZParser, collect-on-host/parse-off-host
Velociraptor — VQL, artifacts, fleet hunts, offline collector
Zimmerman tools — one parser per artifact, Timeline Explorer, cheat recipes
Plaso & super-timelines — log2timeline/psort, filtering, Timesketch

Adding a tool

python new.py tools/<name> -t tool — the template has the cheat-sheet structure. It appears in the sidebar automatically.