“digital-forensics”的搜索结果

Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.

中文简介正在准备中。当前显示英语简介。

• Preserve evidence before starting an incident investigation
• Inspect processes and connections in memory dumps
• Build timelines from event logs and execution traces

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.

中文简介正在准备中。当前显示英语简介。

• Reconstructing a program execution timeline
• Investigating potentially renamed executables
• Reviewing suspicious tools and execution frequency

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

中文简介正在准备中。当前显示原文说明。

Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis. References industry-standard tools including Splunk, ELK Stack, and Wireshark. Provides forensic workflow from initial evidence collection through final investigation report. Keywords: digital forensics, breach investigation, evidence preservation, chain of custody, root cause analysis, Splunk, ELK, Wireshark.

中文简介正在准备中。当前显示原文说明。

Use when a task needs the judgment of a Digital Forensics Analyst — capturing volatile evidence before it's lost, creating and hash-verifying a forensic disk image, documenting chain of custody from point of seizure, correcting for clock skew and timezone mismatches when building a cross-source timeline, or identifying anti-forensic activity (log wiping, timestomping) in an investigation.

中文简介正在准备中。当前显示原文说明。

Generate log2timeline and Plaso super-timelines and triage them in Timesketch.

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

中文简介正在准备中。当前显示原文说明。

Expert en forensique numérique (disk imaging, memory analysis, network forensics, chain of custody)

中文简介正在准备中。当前显示原文说明。

Expert en forensique numérique avancée (disk imaging, memory analysis, network forensics, reporting, chain of custody, incident response)

中文简介正在准备中。当前显示原文说明。

Digital forensics v3 — disk imaging, memory analysis, network forensics, chain of custody, legal

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

中文简介正在准备中。当前显示原文说明。