Examination lab
Practice areas
Each area describes a kind of examination: the questions it answers, the evidence it rests on, and the artifacts, procedures and tools behind it. Nothing here describes bypassing device security; it describes what evidence exists and how it is read.
Workstations, laptops and servers
Computer and disk forensics
Examination of Windows, macOS and Linux systems from a verified image: execution, file access, devices, accounts and deletion, with artifact references.
Android, iOS and messaging apps
Mobile device forensics
Examination of phones and tablets: extraction types, system and app databases, backups, identifiers and the limits of what each extraction can show.
Volatile data, running state
Memory and live-system forensics
Capturing and analysing RAM and the running state of a system: processes, connections, injected code, decrypted volumes, with order-of-volatility rules.
Traffic, flows and infrastructure logs
Network forensics
Packet captures, flow records, DNS, DHCP, proxy, firewall and VPN logs: how to tie an address to a device and a time, and where that chain breaks.
Microsoft 365, Google Workspace, IaaS
Cloud and SaaS forensics
Audit logs, sign-in records, mailbox and file activity in cloud services; preservation holds, exports and the limits of provider-side evidence.
Headers, authentication, mailbox stores
Email forensics
Authenticating an email: Received chains, Message-ID, SPF, DKIM and DMARC results, mailbox stores and the difference between a forwarded copy and the original.
Ransomware, intrusion, insider
Incident response and breach investigation
Scoping an intrusion from first alert to root cause: triage, attacker timeline, affected accounts and data, and evidence for notification decisions.
Collection, processing, review, production
eDiscovery and document review
Defensible collection of documents and mail for litigation or investigation: scope, custodians, hashing, de-duplication, filtering and traceable production.
Metadata, structure, provenance
Image, video and document authentication
Whether a photo, video, PDF or office document is what it claims to be: metadata, structure, editing traces, time and place consistency, and test limits.
Carrier records, number pairs, cells
Communication records and CDR analysis
Reading carrier call and data records: field meanings, time bases, number normalisation, pair and frequency analysis, and what cell data can say about location.