Evidence & investigation
Preserve evidence, reconstruct events, and explain what the artifacts mean.
Account Discovery
Account discovery enumerates identities available in a system or environment.
Application Window Discovery
Application window discovery enumerates visible application windows to learn what a person is doing.
Browser artifacts
History, cache, and profile records describe different parts of browsing activity.
Browser Information Discovery
Browser information discovery reads browser-related data to learn about a user or environment.
Chain of custody
Understand evidence identifiers, handling records, transfers, and integrity checks through a digital-investigation example.
Cloud Infrastructure Discovery
Cloud infrastructure discovery enumerates resources such as instances, networks, and storage relationships.
Cloud Service Dashboard
Cloud dashboard discovery gathers information through a management interface rather than direct command-line APIs.
Cloud Service Discovery
Cloud service discovery enumerates available managed services after access.
Computer forensics
Interpret host artifacts in the context of a question and a system.
Container and Resource Discovery
Container and resource discovery enumerates orchestration objects that reveal workload and infrastructure relationships.
Deleted files and recovery
Deletion changes references and storage state; recovery is not guaranteed.
Digital forensics
Learn how digital forensics preserves evidence, reconstructs events, and separates supported findings from uncertain interpretations.
Disk imaging
Capture storage consistently and verify the copy before analysis.
Domain Trust Discovery
Domain trust discovery learns relationships that permit access across identity domains.
Evidence acquisition
Collect what is needed while recording unavoidable changes and constraints.
File and Directory Discovery
File and directory discovery maps available storage locations and names before targeted collection or execution.
File carving
Reconstruct content using file structure when filesystem records are missing.
File metadata and timestamps
Metadata describes a system’s records, not a complete human history.
Forensic reporting
Explain the question, methods, findings, and limits in a reproducible form.
Hexadecimal analysis
Inspect bytes directly to understand formats and verify tool interpretations.
Incident timelines
Reconstruct events without treating proximity as proof of causation.
Memory forensics
Examine volatile system state that persistent storage may not preserve.
Network forensics
Reconstruct communication using captures, flow records, and service logs.
Network Service Discovery
Network service discovery identifies reachable services and ports on other systems.
Network Share Discovery
Network share discovery enumerates shared folders and storage locations.
Network Sniffing
Network sniffing captures traffic visible to an interface or monitoring point.
Order of volatility
Prioritize evidence that is likely to disappear first, with context.
Packet analysis
Read protocols and conversations without assuming full visibility.
Password Policy Discovery
Password policy discovery learns rules that shape authentication guessing or credential strategy.
Peripheral Device Discovery
Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities.
Permission Groups Discovery
Permission-group discovery examines group membership and privilege relationships.
Process Discovery
Process discovery enumerates running software to understand a host's purpose and defenses.
Processes in memory
Use multiple views to understand execution and potential anomalies.
Query Registry
Registry querying examines Windows configuration data that may reveal software, identities, or persistence opportunities.
Remote System Discovery
Remote system discovery identifies other hosts reachable or known from an accessed environment.
Scheduled tasks and startup artifacts
Recurring execution may be legitimate automation or a surviving foothold.
Software Discovery
Software discovery inventories installed products and versions to guide further actions.
System Information Discovery
System information discovery learns operating-system and hardware details.
System Location Discovery
System location discovery estimates a host's geographical context from configuration or other clues.
System Network Configuration Discovery
Network configuration discovery learns addresses, routes, interfaces, and related settings that describe a host's connectivity.
System Network Connections Discovery
Network connection discovery queries existing connections to learn which systems and services communicate.
System Owner/User Discovery
System owner discovery identifies the users associated with a host.
System Service Discovery
System service discovery identifies installed or running services that reveal a host's purpose, defenses, or possible follow-on targets.
System Time Discovery
System time discovery learns local time or timezone information.
tcpdump
Capture or inspect packets from a command-line environment.
Virtualization/Sandbox Evasion
Sandbox evasion changes behavior when software recognizes a virtual or analysis environment.
Volatility
A framework for interpreting captured memory with appropriate symbols and plugins.
Windows Registry artifacts
Configuration records can provide clues when their semantics are understood.
Wireshark
Inspect captured traffic with protocol-aware views and filters.
Write blockers
Reduce the chance of altering source storage during examination.