DFIR, EVIDENCE, TRIAGE

Digital Forensics - practical teams

The most commonly used Windows, Linux and macOS commands to collect evidence, view network data and logs. Above - simple diagrams of how the investigation is going. Only for training and authorised investigation.

Sequence of evidence

Order of Volatility (RFC 3227) - collect the most volatile first

Order of volatility Seven levels of evidence from the most volatile (CPU/RAM) to the most stable (archives) with the relevant teams. Order of Volatility - RFC 3227 The higher the data disappears - collect them first Collect from top down 1. CPU registers and cache nanoseconds - practically impossible (hardware-level) 2. RAM - RAM processes, network connections, keys, injected code AVML, winpmem, LiME 3. Condition of the network active compounds, ARP, DNS cache, routes ss, netstat -ano, arp -a 4. Temporary files / swap /tmp, pagefile.sys, hiberfil.sys mount, ls, find 5. Disc (HDD / SSD) accurate disc copy and hash check dd, ddrescue, sha256sum 6. Logs on another server syslog, SIEM, journald, auditd journalctl, Get-WinEvent 7. Archives and backup copies less volatile non-binding media (offline media) IETF RFC 3227, NIST SP 800-86 - read RAM BEFORE switching, if possible

In practice

At the beginning of the incident helps to decide what to collect first. The higher the list, the faster the data disappears - the RAM disappears, turning off the computer. Connections change in seconds.

Reference

IETF RFC 3227 (2002) - Guidelines for Evidence Collection and Archiving, NIST SP 800-86, ISO/IEC 27037.

Safety Note

The computer disables the RAM (processes, encryption keys, malware memory). If you can, read the memory first and then disconnect the current.

NIST SP 800-86 - ISO/IEC 27037, 27041-27043

Investigation process - from medium to proof

NIST SP 800-86 Four phases: collection, research, analysis and report. The medium becomes data, information, evidence. Below ISO/IEC standards for each part. 1. Collection identify and obtain in order of volatility hash, evidence chain 2. Research retrieves data from the copy filtration of known (NSRL) recover deleted Analysis timeline correlation between sources hypotheses and their verification Report conclusions and limits methods and tool versions repeatable for other mediumdatainformationevidence ISO/IEC 27037identifies, collects, stores ISO/IEC 27041validation of methods and tools ISO/IEC 27042analysis and interpretation ISO/IEC 27043principles of investigation During the incident, forensics takes place in detection and response actions (NIST SP 800-61 Rev. 3).

In practice

In each phase another question: what to collect, what in it is, what it means, what can be proven. The report must be such that another expert with the same data arrives at the same. Incident response.

Reference

NIST SP 800-86 (Chapter 3), ISO/IEC 27037:2012, 27041:2015, 27042:2015, 27043:2015, NIST SP 800-61 Rev. 3 (2025).

NIS2 deadlines

Investigation should not delay reporting: early warning 24 h, incident notification 72 h, final message one month after notification. Report what is known and add later.

Where evidence is found

Evidence Source Map - Windows / Linux / macOS

Evidence sources map Six types of evidence and their location + team in Windows, Linux and macOS systems. Map of sources of evidence Windows √ Linux / Unix √ macOS Memory and processes pagefile.sys, hiberfil.sys winpmem, Get-Process /proc/kcore, /dev/mm AVML, LiME, ps aux SIP limits RAM production sysdiagnose, ps aux, vmmap Network and compounds TCP table, DNS cache netstat -ano, Get-NetTCP… /proc/net, pockets ss -tupn, lsof -i, arp -a BSD netstat, pocket netstat -an, lsof -i, nettop Journals and events ...\winevt\Logs\*.evtx wevtutil, Get-WinEvent /var/log, journald, auditd journalctl, ausearch unified log, /var/db/diagnostic log show, log stream Files and timeline $MFT, USN $J fsutil usn, dir /T inode time/mtime/ctime find, stat, debugfs FSEvents, Spotlight, xattr mdls, xattr, stat -f Persistence Run keys, Scheduled Task reg query, schtasks cron, systemd units crontab -l, systemctl LaunchAgents/Daemons launchctl, plutil Users and sessions SAM, active sessions net user, query user utmp/wtmp/btmp, passwd who, w, last, lastb dslocal plist, loginwindow dscl . -list /Users, w

In practice

Quickly find where concrete evidence is in each system and which team to get it. The full arguments are set out in the table below.

Reference

SANS DFIR artefact references, MITRE ATT&CK - Collection (TA0009), Windows / Linux forensics references.

Safety Note

Always record the system time zone and clock shift - without it, it is not possible to correct events in order (UTC or local time).

Generation and integrity flow

Chain of Customs - the original never changes

Chain of Customs workflow Six steps: identify, write-block + aquire, hash, verify, analyze copy, document. Chain of Customs - integrity of evidence 1. Identify and isolate disconnect the network, fix time lot:. 2. Write-block + Acquire bit-for-bit image dd, ddrescue, ewfacquire 3. Hash (original) SHA-256 before analysis sha256sum, Get-FileHash 4. Verifies is the copy = original? hash match 5. Analyse the COPY never original read-only mount 6. Documented what, when, where, why custody log Hash before and after: if not consistent, proof not reliable

Step by step proof path

As proof move from hand to hand so that later it can prove that it has not been changed.

Laptop from a suspicious incident

  1. 1
    ResponderPhotograph and record:

    Before touching something, document the situation. It can no longer be restored.

  2. 2
    ResponderFirst volatile data: RAM, network connections

    By turning the computer off, they disappear forever - so collect them first (RFC 3227).

  3. 3
    ResponderDisc image through write-blockerSHA-256: 9f2c..

    Write-blocker does not allow to record in the original. Fingersum is a fingerprint that later proves that nothing has been changed.

  4. 4
    Responder → Storesealed original

    Chain record: handing over, date, time, seal number

    Each transfer shall be recorded. The original shall be kept locked and no longer analysed.

  5. 5
    Storage → Laboratorycopy of work, not original

    Chain Record: to whom issued, when and why

    The analyst works only with a copy.

  6. 6
    LaboratoryBefore analysis recalculates the confusionSHA-256: 9f2c..match

    If the amount does not match, the copy is not reliable and the analysis does not start.

  7. 7
    LaboratoryAnalyzes will only be conducted in reading mode, each action shall be recorded

    Later, another expert must be able to repeat the same and arrive at the same result.

  8. 8
    Laboratory → Storageback copy + message

    Chain Record: Backed, Mixed

    The chain is continuous: at every moment we know who held the evidence.

In practice

It shall be ensured that the evidence can be used in court - proof of where it comes from and that it has not been changed.

Reference

ISO/IEC 27037 (Identification, collection, acquistion, conservation), NIST SP 800-86, ACPO Good Practice Guide (2012; UK now Forensic Science Regulator Code of Practice).

Safety Note

The addition of Write-Blocker or read-only does not allow for random writing in the original. Only the verified copy, not the original, shall always be analysed.

Where to look for typical traces

Artefact roads - folders and files (Windows / Linux)

Windows

Enforcement C:\Windows\Prefetch\*.pf C:\Windows\AppCompat\Programs\Amcache.hve C:\Windows\System32\sru\SRUDB.dat
Register (hives) C:\Windows\System32\config\ (SAM, SYSTEM, SOFTWARE, SECURITY) %USERPROFILE%\NTUSER.DAT %LOCALAPPDATA%\Microsoft\Windows\UsrClass.dat
Logs C:\Windows\System32\winevt\Logs\*.evtx
Files / timeline C:\$MFT C:\$Extend\$UsnJrnl:$J C:\$LogFile
User Activity %APPDATA%\Microsoft\Windows\Recent\ (LNK, Jump Lists) %LOCALAPPDATA%\Google\Chrome\User Data\Default\History
Persistence C:\Windows\System32\Tasks\ %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
Temporary / Memory C:\pagefile.sys, C:\hiberfil.sys %LOCALAPPDATA%\Temp\, C:\Windows\Temp\

√ Linux / Unix

Logs /var/log/auth.log, /var/log/secure /var/log/syslog, /var/log/messages /var/log/audit/audit.log /var/log/journal/
Application (utmp) /var/log/wtmp, /var/log/btmp, /run/utmp /var/log/lastlog
User Activity ~/.bash_history, ~/.zsh_history ~/.ssh/authorized_keys, ~/.ssh/known_hosts
Accounts /etc/passwd, /etc/shadow, /etc/group /etc/sudoers, /etc/sudoers.d/
Persistence /etc/crontab, /var/spool/cron/, /etc/cron.d/ /etc/systemd/system/, /usr/lib/systemd/system/ /etc/rc.local, /etc/init.d/
Temporary/ staging /tmp, /var/tmp, /dev/shm
Processes/packages /proc/PID/{cmdline,exe,maps,fd} /var/log/dpkg.log, /var/log/apt/, /var/log/yum.log

√ macOS

Unified log / log /var/db/diagnostics/*.tracev3 /var/log/system.log (legacy) /var/log/install.log
Persistence ~/Library/LaunchAgents/ /Library/LaunchAgents/, /Library/LaunchDaemons/ /System/Library/LaunchDaemons/
User Activity ~/Library/Preferences/*.plist ~/.zsh_history, ~/.bash_history ~/Library/Safari/History.db
Accounts /var/db/dslocal/nodes/Default/users/*.plist /Library/Preferences/com.apple.loginwindow.plist
Quarantine / Provenities …/com.apple.LaunchServices.QuarantineEventsV2 xattr com.apple.quarantine
FS Events / Spotlight /.fseventsd/ /.Spotlight-V100/
Temporary /tmp, /var/tmp, /private/tmp

Machine-readable catalogues and reference data sets

Community, YaML
Digital Forensics Artifacts Repository

Artefact catalogue for tools: where each artefact is located and on which system. The tool reads it itself, so the collection can be repeated and checked instead of writing paths by hand.

github.com/ForensicArtifacts/artifacts
NIST, NSRL
National Software Reference Library (RDS)

Hash database of known files. It filteres normal system and program files from disk copies, and only those that need to be viewed remain.

nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl
NIST, CFREDS
Computer Forensic Reference Data Sets

Training evidence sets with a certain correct answer - for training and testing your method.

cfreds.nist.gov
NIST, CTTT
Computer Forensics Tool Testing

Methodology and results of testing for forensics tools. It is not only a finding that is important in the Court, but also the tool it has been obtained and whether it has been tested.

nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-lift

In practice

Where to look for the most common evidence. Suitable for the first viewing (triage) and setting of KAPE or CyLR. If there are many computers, the roads are taken from the artifact catalogue, not from this list.

Reference

SANS DFIR √Windows Forensic Analysis anywhere, MITRE ATT&CK, Linux forensics References, ForensicArtifacts (YAML), NIST NSRL, CFReDS, CFTT.

Safety Note

Roads with % are variables which differ for each user. Check all user profiles, not only current.

Command reference
62 teams
Linux Windows macOS Cross
CommandCategoryOSDescriptionMain arguments
ps aux Memory & Processes Linux Current process snapshot - PID, user, CPU/MEM, command line aux BSD style (all processes)
-ef System V style
--forest process wood
-eo pid,ppid,user,cmd optional columns
--sort=-%mem ordered by memory
-p PID specific process
pstree -p Memory & Processes Linux Process hierarchy with PID - detect suspicious parent/child connections -p shows PID
-a shows arguments
-u shows user shifts
-s PID specific process context
-n after PID
lsof Memory & Processes Linux Open files and sokets after the process - critical IoC hunting -p PID specific process
-i network connections
-i :4444 specific port
-u user by user
+D /dir recursive in the directory
-n without DNA resolve
-P without port names
tasklist Memory & Processes Windows Process List (cmd) - PID, session, memory, services /v details (user, title)
/svc services in each process
/m modules loaded (DLL)
/fi "imagename eq x.exe" filter
/fo csv CSV format
/nh without header
Get-Process Memory & Processes Windows PowerShell - processes with properties, roads, hash potential -Id N post PID
-Name x by name
-IncludeUserName show owner
| Sort CPU -Desc
| Select Name,Path,Id
| Format-List * all fields
wmic process Memory & Processes Windows Full Command Line Processes (open LOLBins, encoded PowerShell) process get name,processid,commandline
process where "name='x.exe'" filter
/format:csv CSV Output
process get executablepath
piez.: novecojis - skat. Get-CimInstance Win32_Process
AVML Memory & Processes Linux Microsoft - Kernel-agnostic Linux RAM dump (LiME format) output.lime destination (positional)
--compress compress the stream
--source /proc/kcore source selection
note 1: one binary, not to be combined against the kernel
winpmem Memory & Processes Windows Windows physical memory acquisition (RAW / AFF4 / ELF) -o mem.raw output file
--format raw/aff4/elf
--volume_format raw
--compression snappy
-d driver alternative signed driver
vol (Volatility 3) Memory & Processes Cross Memory analysis frame - processes, network, injected code, register from RAM (Win/Linux/Mac) -f mem.raw memory image
windows.pslist / windows.pstree processes
windows.malfind imported code
windows.netscan network connections
windows.registry.hivelist registry hives RAM
linux.bash shell history of the RAM
mac.pslist / mac.netstat macOS plugins
-o out/ output dir
tcpdump Network / traffic Linux Network traffic capture and PCAP reading with BPF filters -i eth0 interface
-w out.pcap write to file
-r in.pcap read PCAP
-nn without DNA/ports
-s 0 full package length
-A ASCII payload
-X hex + ASCII
'tcp port 443 and host X' BPF
-c N stop after N
tshark Network / traffic Cross Wireshark CLI - read PCAP, extract objects, use display filters -r capture.pcap read
-Y "http.request" display filter
-T fields -e ip.src -e tcp.dstport
--export-objects http,out/
-z follow,tcp,ascii,0 TCP current
-z conv,tcp summary of negotiations
ss Network / traffic Linux Socket statistics (replaces netstat) - active compounds + processes -t TCP
-u UDP
-l opened
-p process/PID
-n numerical (without DNA)
-a all
-tulpn typical combination
-o timers
netstat -ano Network / traffic Windows Active connections + Owner PID (Windows) -a all connections and ports
-n numerical
-o shows PID
-b indicates binary (should be admin)
-r route table
| findstr ESTABLISHED
Get-NetTCPConnection Network / traffic Windows PowerShell - TCP connections to state and process -State Established
-LocalPort N
-RemoteAddress X
-OwningProcess PID
| Sort State
| Select Local*,Remote*,State,OwningProcess
ip Network / traffic Linux Addresses, routes, ARP neighbors (alternate ifconfig/route/arp) ip a addresses
ip r routes
ip neigh ARP/NDP table
ip -s link interface statistics
ip route get X road to X
arp -a Network / traffic Cross ARP Cache Table - MAC↔IP Link (lateral movement evidence) -a all records
-n liquid crystal devices (LCD)
-d host delete entry
note 1: Windows and Linux differ in flags
pktmon Network / traffic Windows Built-in Windows Packet Monitor (Win10 1809+) start --capture start capture
stop stop
pcapng PktMon.etl -o out.pcapng convert
filter add -p 443 add filter
filter list
ipconfig /displaydns Network / traffic Windows DNA resolution cache content - reveals C2/exfil domains /displaydns show the cache
/flushdns clear (NEDARI investigation)
note 3: PowerShell Alternative - Get-DnsClientCache
netstat -an / nettop Network / traffic macOS macOS active compounds (BSD netstat) + live throughput monitor netstat -an all compounds
netstat -rn routes
lsof -i connections to PID
nettop live per-process network
piez.: BSD netstat NAV -p (lieto lsof -i)
journalctl Windows / Events Linux systemd log - search with forensical friendly flags --since 'YYYY-MM-DD HH:MM:SS'
--until '...'
-u sshd unit filter
_UID=1000 by user
-k kernel messages
--list-boots list boot
-o json JSON Output
ausearch Windows / Events Linux Linux auditd - asks audit.log after various predicates -m USER_LOGIN/SYSCALL event type
-ts today / -te now time range
-ui UID audit user ID
-x /bin/bash executable
-k key after audit layer
-i interpret ID
aureport Windows / Events Linux Linux auditd - summary reports from audit log --auth summary of authentication
--login login report
-x executable
-f access to files
--summary short numbers
--start/--end TIME
last / lastb Windows / Events Linux wtmp successful / btmp failed login attempts last successful login (wtmp)
lastb failed (btmp, need root)
-F full times
-i shows IP
-n N last N
-f /var/log/wtmp.1 alternative file
dmesg Windows / Events Linux Kernel Ring buffer - drivers, USB, OOM, anomalies -T human-readable times
-l err,warn level 1 filter
-w follow
--level=err
-x decode prefixes
Get-WinEvent Windows / Events Windows PowerShell - asks Windows event logs (also .evtx files) -LogName Security
-FilterHashtable @{LogName='Security';Id=4625}
-MaxEvents N
-Path file.evtx from file
-Oldest
| Where TimeCreated -gt (Get-Date).AddDays(-1)
wevtutil Windows / Events Windows Event log CLI - query, export, log list qe Security ask events
/f:text text format
/c:N limit the number
/q:"*[System[(EventID=4624)]]" XPath
epl Security sec.evtx export
el list logs
Get-EventLog Windows / Events Windows Classical Event Log (System/Application/Security) -LogName Security
-Newest N
-After (Get-Date).AddHours(-2)
-EntryType FailureAudit
-InstanceId 4625
note 1: older than Get-WinEvent
grep / zgrep Windows / Events Linux Search in magazines - IoC, IP, usernames (zgrep .gz files) -r recursive
-i historically
-E 'regex' extended
-A/-B/-C N context lines
-c count
-o only coincidence
zgrep for compressed or liquefied-gas fuels
log show Windows / Events macOS macOS unified log - consolidated system events (alternate syslog) --last 1h last hour
--predicate 'eventMessage CONTAINS "ssh"'
--info --debug include low level
--style syslog/json/compact
log stream live events
log collect --output a.logarchive export
dd Disk & Files Linux Block-level disc image acquisition - bit-for-bit copy if=/dev/sdb input device
of=image.dd output file
bs=4M block size
conv=noerror,sync continue on mistakes
status=progress live progress
iflag=fullblock complete units
ddrescue Disk & Files Linux Persistent display of damaged media with a map file -n without scrape (fast move 1)
-r3 3 repetitions for bad sectors
-d direct access
INPUT OUTPUT MAPFILE positional
-f overwrite output
find Disk & Files Linux Search of files by time/owner/rights - IoC hunting -mtime -7 modified during the last 7 days
-mmin -60 last hour
-newer ref younger than ref
-perm /4000 setuid bits
-user UID
-size +10M
-exec sha256sum {} +
stat Disk & Files Linux File MAC times (atime/mtime/ctime) and inode metadata -c '%n %x %y %z' format
--printf without a new line
-f file system info
note 1: ctime = inode change, can not be faked by touch
mount -o ro,loop Disk & Files Linux Adding disk image to read ONLY (forensic safe) -o ro read-only
-o noexec,nodev,noload
-o loop loop device
-o offset=N offset of compartment in bytes
-t ext4/ntfs FS type
fsutil Disk & Files Windows Windows FS utility - USN log, file layout usn readjournal C: USN $J entries
file layout C:\file
fsinfo ntfsinfo C:
usn queryjournal C:
hardlink list C:\file
Get-ChildItem Disk & Files Windows PowerShell file accounting with times (also hidden) -Recurse recursive
-Force hidden/systems
-Filter *.exe
| Select FullName,LastWriteTime,Length
-Path C:\ -File
| Sort LastWriteTime
dir /T Disk & Files Windows File times (cmd) - creation / access / writing /T:C time of creation
/T:A access time
/T:W writing time
/A:H hidden
/S recursive
/O:D sort after date
mdls Disk & Files macOS macOS Spotlight metadata - including download source and times file all metadata
-name kMDItemWhereFroms download URL
-name kMDItemDownloadedDate
-name kMDItemFSCreationDate
note 1: kMDITem* fields very rich
xattr Disk & Files macOS macOS extended attributes - com.apple.quarantine (download trends) -l file show all xattr
-p com.apple.quarantine file
-d attr file delete attribute
-r recursive
note 1: quarantine = where the file was downloaded
sha256sum Integrity Linux SHA-256 hash + verification (forensic preferred) file calculate hash
-c sums.txt verify
-b binary mode
--status silent (exit code only)
--ignore-missing
md5sum Integrity Linux MD5 hash - inherited, compatible with old tools file
-c sums.txt verify
-b binary
note 1: MD5 cryptographically broken - used alongside SHA-256
hashdeep Integrity Linux Recursive wood hash + audit against known cluster -c md5,sha256 multiple algorithms
-r recursive
-x negative audit (not known)
-m known.txt compare
-k load known set
Get-FileHash Integrity Windows PowerShell hash (SHA256 by default) -Algorithm SHA256
-Path file
-Algorithm MD5/SHA1
| Format-List
Get-ChildItem | Get-FileHash
certutil -hashfile Integrity Windows Built-in Windows hash tool (do not install anything) file SHA256
file MD5
file SHA1
piez.: certutil -hashfile C:\file SHA256
shasum / md5 Integrity macOS macOS built-in hash tools - shasum (SHA) and md5 shasum -a 256 file SHA-256
shasum -a 1 file SHA-1
shasum -c sums.txt verify
md5 file MD5
md5 -q file only hash
piez.: shasum -a 256 ekvivalents sha256sum
crontab -l Persistence / triage Linux Planned tasks - a place of frequent persistence -l shows list
-u user other user crontab
ls /etc/cron.d /etc/cron.daily
cat /etc/crontab system crontab
note 1: check all users of crontabs
systemctl Persistence / triage Linux systemd services and units - consistency through unit files list-units --type=service
list-unit-files --state=enabled
status sshd
is-enabled x
cat x.service show the unit file
--user user units
who / w Persistence / triage Linux Current interactive sessions (utmp) who basic list
who -a all info
who -b last boot
w users + their commands
w -s short format
schtasks Persistence / triage Windows Planned tasks (cmd) - a common method of continuity /query /fo LIST /v detailed
/query /tn "\path\task"
/fo csv CSV
note: See also C:\Windows\System32\Tasks\
Get-ScheduledTask Persistence / triage Windows PowerShell scheduled tasks with actions and triggers | Where State -eq 'Ready'
-TaskName x
| Get-ScheduledTaskInfo last/last launch
| Select TaskName,TaskPath,State
-TaskPath '\' root tasks
net user Persistence / triage Windows Local accounts and groups - newly created/suspected users net user list 1
net user X account details
net localgroup administrators
net session active SMB sessions
net accounts password policy
query user Persistence / triage Windows Application Users and Sessions (RDP/Local) query user (quser)
query session (qwinsta)
note 1: Opens active RDP sessions
logoff ID termination of session
autorunsc Persistence / triage Windows Sysinternals - all autostart recording with hash -a * all autostart categories
-c CSV Output
-h file hash
-m hide MS signed
-s verify signatures
accepteula
launchctl Persistence / triage macOS macOS launchd - services and LaunchAgents/LaunchDaemons (persistence) list loaded tasks
print system system domain
print gui/501 user domain
dumpstate full state
piez.: plist ~/Library/LaunchAgents, /Library/Launch*
dscl Persistence / triage macOS macOS Directory Service CLI - local accounts and groups . -list /Users users
. -read /Users/x account details
. -list /Groups
. -read /Groups/admin GroupMembership
note 1: discover hidden/newly created accounts
reg query Register/artefacts Windows Life Register Query - Autostart (Run), Services, Configuration HKLM\...\CurrentVersion\Run
HKCU\...\Run
/s recursive
/v value specific value
/f "text" /s search
piez.: Run, RunOnce, Services, AppInit_DLLs
Get-ItemProperty Register/artefacts Windows PowerShell - Read registry key values -Path 'HKLM:\...\Run'
Get-ChildItem 'HKLM:\...' subkeys
| Select *
-Name ValueName
piez.: HKLM: un HKCU: ir PSDrives
RegRipper Register/artefacts Windows Plugins offline (NTUSER, SYSTEM, SOFTWARE, SAM) -r hive hive file
-f ntuser/software/system/sam
-p plugin one plugin
-l available plugins
-a all profile plugins
piez.: rip.pl (Perl) / rr.exe
reglookup Register/artefacts Linux Read Windows registry hives from Linux (export keys) hive hive file (positional)
-p PATH specific road
-H without header
-s show types
note 1: reglucup-timeline timeline for analysis
hivexsh / hivexget Register/artefacts Linux libhivex - Windows live browsing / removing values from Linux hivexsh hive interactive
hivexget hive "\path" value extract value
komandas: ls / cd / lsval / cat
hivexregedit --export to .reg
plutil Register/artefacts macOS macOS - pist (binary↔XML) - macOS register -p file.plist man-readable
-convert xml1 file.plist binary→XML
-convert json file.plist
-lint file.plist validated
piez.: daudzi artefakti ir binary plist
defaults Register/artefacts macOS macOS - Read app preferences (plist domains) read domain read domain
read file.plist
domains list all domains
read com.apple.dock
piez.: ~/Library/Preferences/*.plist

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

DFIR
Digital Forensics and Incident Response - digital forensics and incident response.
RAM
Random Access Memory - ram - turning the computer off, its content disappears.
MFT
Master File Table - Main table of the NTFS file system with details of each file.
USN
Update Sequence Number journal - MMFS log for file changes.
SAM
Security Account Manager - Windows local account database.
FSEvents
MacOS file system change log.
ARP
Address Resolution Protocol - IP address ↔ network card address table.
KAPE / CyLR
Tools for quick artifact collection from Windows computers.
LiME / AVML
Tools for reading Linux memory.
NSRL / RDS
National Software Reference Library / Reference Data Set - NIST known software fileprint set.
CFReDS
Computer Forensic Reference Data Sets - NIST training evidence sets.
CFTT
Computer Forensics Tool Testing - NIST Forensics tool testing programme.
ACPO
Association of Chief Police Officers - UK police guidelines for digital evidence.
RFC 3227
IETF guidelines for evidence collection (volatileity sequence).
HDD / SSD
Hard Disk Drive / Solid-State Drive - magnetic / flash drive.
SHA-256
The hybrid function for the evidential imprint shall demonstrate that the copy has not been changed.
Write-blocker
Device or program that does not allow writing on the original disk.
UTC
Coordinated Universal Time - common time zone for events to be grouped in order.
MITRE ATT&CK
An attacker's tactics and technical knowledge base.