Investigate Security Incidents with Forensic Artifacts

Digital Forensics & IR Artifacts is an authorized-use skill for investigating suspected security incidents with forensic rigor and building defensible timelines from disk, memory and network artifacts. It covers memory dump analysis with Volatility 2/3, disk and E01 image timelines, PCAP source tracing and protocol reconstruction, host artifacts (Prefetch, Shimcache, Windows Event Log, browser history), and incident-response IOC extraction.

The workflow has four stages. Preservation: compute SHA256 hashes, record timezone and acquisition commands, work only on copies while keeping originals read-only, and note chain of custody in the timeline. Memory: run Volatility 3 against the memory dump to profile the system, list processes, inspect network connections and recover command lines.

vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline

Host artifacts: review Security, PowerShell and Sysmon event logs; check persistence via Run keys, services, scheduled tasks and WMI; and check execution traces in Amcache, Prefetch and BAM. Network: use tshark to summarize sessions and DNS activity, then export suspicious flows for protocol reconstruction or malware C2 analysis.

Its toolchain names Volatility 3 for memory analysis, Timeline Explorer and Plaso for super-timelines, tshark for PCAP, the Eric Zimmerman tools for Windows artifacts, and Autopsy or FTK Imager for disk. Forensic triage runs in six stages: preservation and hashing; memory triage covering processes, network and injection; persistence and execution traces; lateral movement and account anomalies; outbound IOCs; and reporting with remediation advice, using a findings table of Time, Host, Artifact, Finding, Confidence and Evidence path.

A self-check before completion asks whether hashes and a copy policy were preserved, whether the timeline can be independently reviewed, and whether IOCs were sanitized and classified.

Use it to investigate a suspected incident with forensic rigor or to build a defensible timeline from disk, memory and network artifacts. Chain-of-custody requirements apply, so work only on verified copies, never originals; encrypted or anti-forensic artifacts may be unrecoverable.

Input is a memory dump, disk or E01 image, PCAP capture, or host artifact set from a suspected incident. Output is a reviewable timeline of findings (time, host, artifact, finding, confidence, evidence path), extracted IOCs, and a remediation-oriented report.

It hands malware samples found during triage to a companion malware-analysis skill and turns IOCs into rules for a companion threat-hunting skill; suspicious network flows route to a protocol-reverse skill for deeper reconstruction.

It suits incident responders and forensic analysts building defensible, chain-of-custody-respecting timelines from memory, disk and network evidence.