performing-endpoint-forensics-investigation

# Performing Endpoint Forensics Investigation ## When to Use Use this skill when: - Investigating a confirmed or suspected endpoint compromise requiring forensic analysis - Collecting volatile and non-volatile evidence for incident response or legal proceedings - Analyzing memory dumps for malware, injected code, or credential theft artifacts - Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache) **Do not use** this skill for live threat hunting (use EDR/SIEM) or network forensics. ## Prerequisites - Forensic workstation with analysis tools (Volatility 3, KAPE, Autopsy, Eric Zimmerman tools) - Write-blocker for disk imaging (hardware or software) - Secure evidence storage with chain-of-custody documentation - Memory acquisition tool (WinPMEM, FTK Imager, Magnet RAM Capture) - Administrative access to the target endpoint (or physical access) ## Workflow ### Step 1: Evidence Preservation (Order of Volatility) Collect evidence from most volatile to least volatile: ``` 1. System memory (RAM) - Most volatile 2. Network connections and routing tables 3. Running processes and open files 4. Disk contents (file system) 5. Removable media 6. Logs and backup data - Least volatile ``` **Memory Acquisition**: ```powershell # WinPMEM (Windows) winpmem_mini_x64.exe memdump.raw # FTK Imager - Create memory capture via GUI # File → Capture Memory → Destination path → Capture Memory # Linux (LiME kernel module) sudo insmod lime.ko "path=/evidence/...