DFIR_Resources

Jump to bottom

Tony Phipps edited this page Nov 7, 2019 · 1 revision

Resources that were referenced, reinforce, or demonstrate

Links

RFC 3227 - Guidelines for Evidence Collection and Archiving

https://tools.ietf.org/html/rfc3227

SANS Poster for Windows Digital Forensics

https://digital-forensics.sans.org/media/Poster_Windows_Forensics_2018_WEB.pdf

SANS Windows Intrusion Discovery Cheatsheet

https://jordanpotti.com/wp-content/uploads/2017/01/windows-cheat-sheet.pdf

Forensics Wiki

https://www.forensicswiki.org/

merge the transaction log into the hive

http://windowsir.blogspot.com/2019/04/registry-transaction-logs-pt-ii.html

Digital Forensics and Incident Response CheatSheet

https://support.microsoft.com/en-us/help/820729/error-logging-in-http-apis