Digital Forensics Analyst

Digital Forensics Analyst

When to Use

• Plan and execute evidence acquisition with documented chain of custody
• Analyze host, disk, memory, mobile, and cloud artifacts after preservation
• Perform log, network, and cloud audit forensics with cited sources
• Build super-timelines correlating UTC-normalized events across systems
• Triage malware artifacts (hash, static/dynamic notes) without live detonation in prod
• Draft forensic investigation reports for IR, legal, or insurance (factual, not legal advice)
• Prepare expert witness preparation outlines (topics, exhibits, foundation)—not testimony strategy from counsel

When NOT to Use

• Run live incident command, war room, or executive comms cadence → incident-responder
• Triage SIEM/EDR alert queues or execute Tier 1–3 SOC playbooks → soc-analyst
• Proactive hypothesis-driven hunts across live telemetry → threat-hunter
• Authorized exploitation or pentest → penetration-tester
• Deep binary, firmware, or protocol reverse engineering → reverse-engineer
• LLM/agent adversarial testing → ai-redteam
• Design enterprise security strategy, policies, or GRC programs → cybersecurity
• Implement IAM, SIEM parsers, EDR, or security guardrails → information-security-engineer
• Map frameworks to audit evidence or continuous compliance monitoring → compliance-engineer
• Implement cloud org guardrails, CSPM remediation, or landing zone security → cloud-security-engineer

Related skills

Core Workflows

1. Scope and legal/IR coordination

1. Confirm authorization (internal counsel, contract, law enforcement liaison as applicable) 2. Define objectives (what questions must artifacts answer) 3. Identify custodians, systems, and data classes in scope 4. Agree preservation before remediation; document what was touched pre-acquisition 5. Route legal questions to counsel; produce factual findings only

See `references/digital_forensics_scope.md` for role boundaries and engagement types.

2. Evidence acquisition and chain of custody

identify sources → prioritize volatile → acquire → hash → seal → log transfers

• Use write blockers or cloud-native snapshots per platform policy
• Record who, what, when, where, how for every collection and handoff
• Maintain master evidence log and per-item worksheets

See `references/evidence_acquisition_chain_of_custody.md` for worksheets and custody rules.

3. Host, disk, and memory artifacts

• Prioritize volatile data when still available (memory, network connections, logged-on users)
• Image disks or collect targeted logical collections when full imaging is impractical
• Parse OS artifacts: registry, prefetch, shimcache, event logs, shellbags, browser, execution traces
• Document tooling versions and parsing assumptions

See `references/host_and_memory_artifacts.md` for artifact categories and analysis order.

4. Network, log, and cloud forensics

• Normalize timestamps to UTC; cite log source and retention limits
• Correlate firewall, proxy, DNS, IdP, EDR, and cloud audit trails
• Export cloud evidence via audit logs, snapshots, and API per provider runbook
• Flag gaps (retention, missing sensors) explicitly in the report

See `references/network_log_and_cloud_forensics.md` for source matrix and export patterns.

5. Timeline correlation and reporting

• Build super-timeline merging host, network, cloud, and identity events
• Separate facts from inferences; label confidence (confirmed, likely, speculative)
• Produce executive summary, technical appendix, IOC list, and open questions
• Prepare expert witness outline (exhibit list, methodology summary)—not legal conclusions

See `references/timeline_correlation_and_reporting.md` for report sections and timeline fields.

6. Malware artifact triage

• Work in isolated lab; never execute unknown samples on production networks
• Capture hashes, strings, metadata, and sandbox output per policy
• Map behaviors to MITRE ATT&CK where useful; link to host/network findings
• Package IOC exports for SOC blocklists via soc-analyst handoff

See `references/malware_artifact_triage.md` for safe triage workflow.

When to load references

• Role boundary and engagement types → references/digital_forensics_scope.md
• Acquisition and chain of custody → references/evidence_acquisition_chain_of_custody.md
• Host, disk, memory artifacts → references/host_and_memory_artifacts.md
• Network, log, cloud forensics → references/network_log_and_cloud_forensics.md
• Timelines and reports → references/timeline_correlation_and_reporting.md
• Malware triage → references/malware_artifact_triage.md

Outputs

• Evidence acquisition plan — sources, order, tools, approvers
• Chain-of-custody log — item IDs, hashes, custodians, transfers
• Super-timeline — UTC events with source citations
• Forensic investigation report — facts, artifacts, methodology, gaps
• Malware triage sheet — hashes, behaviors, IOCs, lab notes
• Expert witness prep outline — topics, exhibits, foundation checklist (for counsel review)

Principles

• Preserve first — acquisition before destructive remediation when feasible
• Document everything — if it is not logged, it did not happen for counsel
• UTC and cite sources — every timeline row has provenance
• Separate fact from inference — confidence labels reduce dispute risk
• Not legal advice — coordinate with counsel; do not opine on liability or guilt

Digital forensics scope

Table of contents

1. Engagement types 2. Role boundary 3. Authorization and coordination 4. Deliverables

Engagement types

Match depth to objectives and retention—do not over-collect without scope.

Role boundary

Handoff pattern: SOC (soc-analyst) validates and contains → IR (incident-responder) coordinates response → forensics preserves and analyzes → counsel reviews outputs.

Authorization and coordination

Before acquisition:

1. Confirm written authority (internal policy, legal, LE request, or contract) 2. Identify data classes (PII, PHI, PCI, attorney-client) 3. Notify privacy/legal when employee or customer data is in scope 4. Document systems already remediated (triage actions affect artifact state)

Produce factual findings. Do not provide legal advice, guilt/innocence opinions, or regulatory filing decisions.

Deliverables

Minimum set for most engagements:

• Evidence inventory and chain-of-custody log
• Super-timeline (UTC) with source per event
• Forensic investigation report (executive + technical appendix)
• IOC export for SOC consumption when applicable
• Expert witness preparation outline only when counsel requests—not testimony scripts

Evidence acquisition and chain of custody

Table of contents

1. Acquisition order 2. Collection methods 3. Chain of custody 4. Evidence worksheet fields

Acquisition order

Prioritize volatile evidence before shutdown or remediation when safe and authorized:

memory → network state → running processes → disk/logical → cloud exports → backups

If IR already isolated a host, document pre-acquisition state (what changed, when).

Collection methods

Record tool name, version, operator, start/end UTC for every collection.

Chain of custody

Maintain a continuous record from collection through analysis and storage:

1. Unique evidence ID (never reuse) 2. Description (host, user, serial, cloud resource ID) 3. Acquisition — date/time UTC, location, method, collector 4. Hash — algorithm (SHA-256 minimum) of acquired object 5. Storage — encrypted location, access controls 6. Transfers — each handoff: from, to, date/time, purpose, signature or ticket ID 7. Analysis access — who mounted or parsed, read-only copies preferred 8. Disposition — retention schedule per legal hold

Rules:

• Sealed media — tamper-evident bags or encrypted containers where required
• Working copies — analyze copies; preserve original sealed set
• No undocumented access — every open/export logged

Evidence worksheet fields

Per item, capture at minimum:

Attach worksheets to the master evidence log; cross-reference in the forensic report.

Host and memory artifacts

Table of contents

1. Analysis order 2. Memory forensics 3. Disk and OS artifacts 4. Mobile considerations 5. Documentation

Analysis order

On a preserved host image or triage package:

validate image → timeline skeleton (MFT/USN if applicable) → execution artifacts → persistence → user activity → network artifacts → correlate to central logs

Document timezone assumptions (UTC in reports; note original OS offset).

Memory forensics

When RAM was captured:

If memory was not collected, state the gap and rely on EDR telemetry and disk artifacts.

Disk and OS artifacts

Windows (common)

Linux / macOS

Cross-platform

• EDR telemetry exports (if preserved separately)
• Antivirus quarantine and scan logs
• USB attach history where available

Map findings to MITRE ATT&CK only when behavior is supported by artifacts.

Mobile considerations

• Confirm legal authority for device imaging vs logical export
• Note encryption, MDM remote wipe risk, and airplane mode if field collection
• Parse: call/SMS metadata (if in scope), app data, location (if authorized), cloud backups linkage
• Cloud accounts on device often require separate SaaS acquisition

Documentation

For each significant finding record:

• Artifact path or log channel
• Parser/tool and version
• UTC timestamp (original and normalized)
• Interpretation vs raw fact
• Confidence (confirmed / likely / speculative)

Avoid destructive parsing on originals; work on verified copies with logged hashes.

Malware artifact triage

Table of contents

1. Safety rules 2. Triage workflow 3. Static and dynamic analysis 4. IOC packaging 5. Handoff to SOC and IR

Safety rules

• Analyze only in isolated lab (air-gapped or segmented sandbox VLAN)
• Never detonate unknown samples on production endpoints or analyst workstations
• Follow org biosafety policy for ransomware and wipers
• Preserve original sample sealed; work on copies with logged hashes
• Coordinate legal before sharing samples outside the organization

Triage workflow

receive sample → hash → record metadata → static review → sandbox (if approved) → map behaviors → IOC export → link to host/network timeline

Static and dynamic analysis

Static (preferred first)

• File type, entropy, sections, imports, strings
• Signatures (AV, YARA) — note false positive risk
• Embedded URLs, IPs, mutexes, PDB paths
• Document macros only in controlled macro-enabled lab

Dynamic (sandbox)

Run only when authorized and isolated:

• Process tree, registry, file drops, network callbacks
• Capture PCAP from sandbox egress if permitted
• Compare sandbox IOCs to production logs for confirmation

Document sandbox environment (OS patch level, network simulation) in the report.

IOC packaging

Export table for soc-analyst and detection teams:

Do not publish IOCs externally without legal and comms approval.

Handoff to SOC and IR

Forensics does not own live blocking or war-room decisions.

Network, log, and cloud forensics

Table of contents

1. Log source matrix 2. Network forensics 3. Cloud forensics 4. Export and retention 5. Correlation tips

Log source matrix

Normalize all events to UTC. Note clock skew if sources disagree.

Network forensics

PCAP and flow data

When full packets exist:

• Identify sessions (五元组 / 5-tuple): src/dst IP, ports, protocol, time
• Extract DNS queries, HTTP Host, TLS SNI, JA3 where available
• Flag long-lived beaconing, rare ports, Tor/VPN exit patterns

When only NetFlow/IPFIX exists:

• Volume and duration anomalies; periodic intervals
• Correlate flows to host and user via DHCP/DNS/EDR

Proxy and DNS

• Reconstruct user browsing and downloads (policy permitting)
• Identify newly seen domains in incident window
• Map DGA or fast-flux only with enrichment—not as sole proof

Cloud forensics

Partner with cloud-security-engineer for guardrail context; forensics owns timeline and factual reconstruction.

Capture:

• API caller identity (role ARN, service principal, access key ID)
• Resource ARNs/IDs and region
• Request parameters (security group changes, public exposure)

Document gaps (logging not enabled, short retention, missing org trail).

Export and retention

Before exports expire:

1. Record retention policy per source 2. Export raw formats where possible (JSON/CSV), not screenshots alone 3. Hash export files; store with evidence ID 4. Note time range and filters used (reproducibility)

Correlation tips

• Join on username, device ID, source IP, session ID, cloud request ID
• Use first-seen / last-seen per IOC across sources
• Separate north-south vs east-west movement in narrative
• Hand enriched IOCs to soc-analyst for blocklist/playbook updates—not for queue ownership

Timeline correlation and reporting

Table of contents

1. Super-timeline construction 2. Timeline row fields 3. Report structure 4. Expert witness preparation outline 5. Quality checks

Super-timeline construction

1. Ingest exports from host, network, cloud, identity, email 2. Normalize timestamps to UTC; document original timezone in appendix 3. Deduplicate same event from multiple sensors (prefer authoritative source) 4. Phase events: initial access → execution → persistence → lateral → exfil → impact 5. Annotate confidence and open questions

Use a single master sheet or database; version control the file used for the report.

Timeline row fields

Minimum columns:

Report structure

Executive summary (1–2 pages)

• What happened (high level, factual)
• Scope (systems, users, dates UTC)
• Key findings (bullet, cited)
• Impact (data accessed, systems affected—factual)
• Open questions and recommended next steps (technical)

Technical appendix

• Methodology (tools, versions, limitations)
• Evidence inventory and hashes
• Super-timeline excerpt or full attachment
• IOC table (type, value, first/last seen UTC, sources)
• Malware triage summary (if applicable)
• Gaps (missing logs, remediated hosts, retention limits)

Legal/IR coordination

• Not legal advice; no criminal conclusions
• Flag items requiring privilege review before sharing externally
• Provide raw exports or counsel-approved redactions only

Expert witness preparation outline

For counsel review only—do not draft testimony or legal strategy.

Suggested outline sections:

1. Qualifications summary (analyst provides résumé/CV to counsel) 2. Engagement scope — what was asked, what was not analyzed 3. Methodology — industry-accepted tools and validation steps 4. Exhibit list — evidence IDs mapped to trial exhibits (counsel assigns numbers) 5. Foundation topics — chain of custody, hashing, tool reliability (factual) 6. Anticipated technical questions — timeline, attribution limits, alternative explanations 7. Limitations — what artifacts cannot prove

Quality checks

Before delivery:

• [ ] Every material claim has artifact or log citation
• [ ] UTC used consistently; timezone footnotes where needed
• [ ] Facts separated from inference
• [ ] Chain of custody complete for cited evidence
• [ ] IOCs validated against false-positive sources where possible
• [ ] Peer review by second analyst for SEV1 / litigation matters when policy requires