Digital Forensics Playbook

Description

A Hands-On Guide to DFIR, Incident Response & Threat Hunting

259 pages · 47 chapters · 30+ labs · 8 challenge investigations · 331-term glossary

Most forensics resources teach you about investigations. This one puts you in the chair.

You’ve read the blog posts. You know Prefetch proves execution and Volatility analyses memory. But when someone hands you a disk image and asks “what happened, and when?” — where do you actually start?

That gap between knowing the terms and working a case is where most people stall. Courses are expensive. Documentation is scattered. And the free tutorials all stop right before the part that matters: how the pieces connect into an answer you can defend.

The Digital Forensics Playbook was built to close that gap.

Every concept is anchored to a real artifact, a real command, and a real decision. Not “the registry stores configuration data” — but which key proves a USB was connected, what its timestamp actually means, and how to corroborate it before you put it in a report.

---

What you’ll be able to do

By the end, you won’t just recognize forensic terminology. You’ll be able to:

• Acquire evidence defensibly — image disks and memory, verify with hashes, maintain chain of custody that survives scrutiny
• Prove what executed on a Windows machine — using Prefetch, Amcache, and Shimcache to corroborate a single fact three ways
• Find malware that never touched disk — the Volatility 3 workflow that exposes hidden processes, injected code, and live C2 connections
• Reconstruct an intrusion timeline — merging filesystem, registry, log, and network timestamps into one chronology
• Catch attackers who tried to hide — detect timestomping via MFT $SI/$FN mismatches, spot cleared logs, and identify living-off-the-land abuse
• Investigate cloud and email compromise — where there’s no disk to image and the logs are the crime scene
• Turn findings into detections — write Sigma rules for logs and YARA rules for files and memory
• Write a report that holds up — separating fact from inference, stated at the confidence the evidence actually supports

---

What’s inside

Foundations & Evidence Handling Locard’s principle, the forensic method, legal authority and admissibility, chain of custody, hashing and integrity, order of volatility.

Acquisition Live vs. dead acquisition, disk imaging (FTK Imager, dc3dd, Guymager), memory capture (WinPmem, AVML), write blockers, image formats, verification.

Windows Forensics — the deepest section Registry hives and high-value keys, UserAssist, ShellBags, Event Logs and the IDs that matter (4624, 4625, 4688, 7045, 1102), Sysmon, Prefetch, Amcache, Shimcache, SRUM, LNK files and Jump Lists, USB artifacts, Recycle Bin, scheduled tasks, services, PowerShell logging, super-timelines.

Linux, macOS, Cloud & Containers /var/log and journald, cron and systemd persistence, SSH keys, /proc recovery of deleted running binaries. macOS: APFS snapshots, Unified Logs, plists, FSEvents, TCC, LaunchAgents. Cloud: CloudTrail, Entra sign-ins, M365 Unified Audit Log. Containers: Docker/Kubernetes evidence capture before pods vanish.

Memory Forensics Why RAM matters, kernel structures, and a complete Volatility 3 workflow — pslist vs. psscan diffing, pstree, cmdline, netscan, malfind, credential extraction, memory timelines.

Filesystem Deep-Dive The MFT and its attributes, deleted-file recovery, slack and unallocated space, file carving with signatures, metadata extraction, alternate data streams, Mark-of-the-Web, timestomping detection.

Logs, Browser, Email & Network Windows/Sysmon/Linux log analysis method, Apache/Nginx, firewall, VPN, DNS, DHCP. Chrome/Edge/Firefox artifacts, Outlook stores, email header analysis, SPF/DKIM/DMARC, phishing triage. Packet capture, Wireshark filters, Follow Stream, file carving from PCAPs, beacon detection.

Malware Analysis Static and dynamic triage, PE format internals, reading capability from imports, entropy and packing, unpacking, anti-analysis techniques, sandboxing, YARA authoring.

Incident Response, Threat Hunting & Reporting The NIST lifecycle, containment vs. evidence preservation, communication and legal obligations. MITRE ATT&CK-driven hunting, the Pyramid of Pain, Sigma rules, detection tuning, purple teaming. Report structure, executive summaries, IOC tables, expert testimony.

Specialized & Emerging Domains Credential theft and lateral movement (LSASS, pass-the-hash, DCSync, RDP/PsExec/WMI artifacts), anti-forensics detection, OT/ICS forensics (Purdue model, PLCs, historians), IoT and embedded forensics, mobile forensics primer.

---

Built for practice, not just reading

30+ structured labs — each with Objectives, Setup, Evidence, Tools, Step-by-Step, Verification, Reporting, and Lessons Learned.

8 self-directed challenges — you work the case. Windows triage, memory, network, ransomware, cloud fraud, Linux compromise, insider theft, and a full-scope capstone. Each gives you the scenario, the questions a real case would ask, progressive hints, and a debrief showing what good looks like.

4 worked case studies — enterprise ransomware, business email compromise, insider data theft, and an eight-month APT intrusion, each traced from first signal to final report.

1 fully guided end-to-end investigation — “The Acme Breach,” walked step by step with the actual commands and representative output at every stage: preserve → establish execution → confirm persistence → memory analysis → network corroboration → scope → timeline → report.

Command-by-command tool tutorials — The Sleuth Kit, Autopsy, KAPE, the Eric Zimmerman suite, Plaso, Volatility 3, Wireshark/tshark, and YARA.

Reference you’ll actually reuse — Windows artifact and registry cheat sheets, Event ID and Sysmon quick reference, Linux and filesystem cheat sheets, Volatility command reference, evidence collection and timeline checklists, chain-of-custody and acquisition worksheets, a report skeleton, and a 331-term glossary.

---

Who this is for

• SOC analysts who want to move from closing alerts to investigating them
• IT admins and sysadmins transitioning into security
• Incident responders who need a structured method and reference under pressure
• Students and career changers building toward a DFIR role
• Pentesters and red teamers who want to understand what they leave behind
• Anyone preparing for DFIR certifications who needs practical grounding, not just exam recall

Who it’s not for: if you’re already a senior forensic examiner doing kernel-level reverse engineering, this will be review. It’s a beginner-to-intermediate book, and it says so honestly.

---

What makes it different

It explains the why, not just the click path. You’ll learn why $FILE_NAME timestamps resist tampering while $STANDARD_INFORMATION timestamps don’t — so you can reason about new artifacts, not just memorize old ones.

It teaches corroboration, not single-artifact conclusions. Real cases get overturned when an examiner rests a finding on one timestamp. This book drills cross-source verification throughout.

It’s honest about limits. Where evidence is ambiguous, where tools produce false positives, where you should say “I couldn’t determine that” — it says so. That restraint is what makes reports defensible.

It uses free, standard tools. Nothing here requires an expensive commercial license. The full lab setup guide uses SIFT Workstation, REMnux, and free Windows tools.

---

Format & delivery

• PDF, 259 pages, designed for both screen and print
• Clickable table of contents and full PDF bookmarks for fast navigation
• Clean, high-contrast layout with diagrams, timelines, comparison tables, and callouts
• [Instant download after purchase / delivery details]
• [Free lifetime updates]

---

Frequently Asked Questions

Do I need prior forensics experience? No. The book starts from first principles — what digital evidence is, how storage and filesystems work, what makes evidence admissible. If you’re comfortable using a computer and willing to work in a terminal, you can follow it.

Do I need a technical background? Basic IT familiarity helps a lot — knowing what a file system is, what an IP address does, being willing to use a command line. You don’t need programming skills or a security background.

What software do I need to buy? None. Every tool taught is free or open source: Autopsy, The Sleuth Kit, Volatility 3, Wireshark, YARA, KAPE, the Eric Zimmerman suite, Plaso, REMnux, SIFT Workstation. Appendix C walks you through building a complete lab at zero software cost.

What hardware do I need for the labs? A laptop or desktop with 16 GB RAM (32 GB is more comfortable), a multi-core CPU with virtualization enabled, and around 250 GB free. Everything runs in VMs so your main system stays clean.

Does it include the sample evidence files? No — the labs are dataset-agnostic by design, and the book points you to excellent free sources: public DFIR challenge images, CTF datasets, the Digital Corpora project, sample memory images, and public PCAP exercises. This keeps the material usable for years as datasets come and go, rather than tying you to files that go stale.

Is this Windows-only? No. Windows gets the deepest coverage because it’s the most common enterprise target, but the book also covers Linux, macOS, cloud platforms (AWS/Azure/M365/GCP), containers and Kubernetes, mobile, OT/ICS, and IoT.

Will this prepare me for a certification? It’s not an exam-prep book tied to any specific certification, and it doesn’t claim to be. But it covers the practical foundations most DFIR certifications test — evidence handling, Windows and Linux artifacts, memory analysis, timeline reconstruction, and reporting — so it pairs well with formal study.

Will this get me a job? No book can promise that, and I won’t. What it can do is give you real, demonstrable skills and a portfolio of worked investigations. The challenges are specifically designed so you can write up your findings and show your method — which is what actually impresses hiring managers.

How is this different from free YouTube tutorials? Free tutorials usually cover one tool or one artifact in isolation. This is a structured, sequenced curriculum that connects them — showing how a registry key, a Prefetch entry, a memory dump, and a firewall log combine into one defensible timeline, and how to communicate that in a report.

Is it up to date? It covers current tooling and techniques — Volatility 3 (not the deprecated v2), Sysmon, KAPE, the modern Zimmerman suite, Sigma, MITRE ATT&CK, and cloud/container forensics. Core forensic principles (filesystem structures, evidence handling, timeline method) change slowly, so the foundations stay valid.

How long will it take to work through? Reading it takes a few focused evenings. Working it — doing the labs and challenges properly — realistically takes several weeks to a few months depending on your pace. It’s built to be worked through, then kept as a reference.

Is it printable? Yes. It’s designed for both screen reading and print, with a clean white layout, readable type, and printable checklists and forms.

Can I use this for my job / team? Yes for personal professional use. [Add your license terms — e.g. single-user license; team licenses available at X]

What if it’s not right for me? [Your refund policy here — e.g. 30-day, no-questions-asked money-back guarantee.]

Is it really 259 pages? Yes — and that’s a deliberate choice. It’s dense, technical content without filler chapters, padded screenshots, or repeated boilerplate. Every page earns its place.