Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Tool

Evidence-gap checker

Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.

Order of volatility

The expensive mistake in the first hour is spending it on a source that will still be there tomorrow while one that rolls hourly quietly empties.

  1. Memory, if the host is still running and you are permitted.
  2. The change journal, which on a busy volume covers hours.
  3. Event logs, 20MB by default and under a day on a domain controller.
  4. Everything on disk, which is still there next week.

Pick a question above. Nothing here is a substitute for knowing your estate: it is the list you would want somebody to hand you before you start, so the volatile sources are not the ones you get to last.