What you'll learn
- Evidence handling
- Windows artifacts
- Linux artifacts
- Memory and timelines
Lessons
1Evidence handling
Follow RFC 3227 order of volatility: CPU/cache → memory → network state → running processes → disk → logs → backups. Hash every image (SHA-256), work on copies, and record a chain of custody: who handled what, when and why.
2Windows artifacts
- Event logs: Security (4624/4625 logons, 4688 process creation, 4720 user created, 1102 log cleared), System (7045 service installed).
- Execution: Prefetch, Amcache, ShimCache, BAM, SRUM.
- Persistence: Run keys, scheduled tasks, services, WMI subscriptions.
- File system: $MFT, $UsnJrnl, $LogFile.
- User activity: LNK files, Jump Lists, ShellBags, browser history.
3Linux artifacts PRO
Check /var/log/auth.log or secure , journalctl , shell histories, cron and systemd units, /etc/passwd changes, authorized_keys, recently modified binaries, and unusual listening pr…
Continue this lesson in the platform →4Memory and timelines PRO
Memory shows what was running: processes, network connections, injected code, command lines. Volatility 3 plugins such as windows.pslist , windows.netscan and windows.cmdline are t…
Continue this lesson in the platform →Hands-on lab: Build a mini timeline from your own system
- On a test Windows VM, open Event Viewer → Security log.
- Filter for IDs 4624, 4625 and 4688 over the last day.
- Export to CSV and sort by time in a spreadsheet.
- On Linux, run
last,journalctl --since todayand review~/.bash_history. - Write a short narrative: who logged on, what ran, and when.
Outcome: Practice reading native artifacts into a timeline.
Practice questions
Which Windows event ID shows the Security log was cleared?
Answer: 1102. 1102 = audit log cleared, a classic anti-forensics sign.
Why hash a forensic image?
Answer: Prove it hasn't changed. Integrity verification for court and peers.
Prefetch files indicate…
Answer: Program execution. Prefetch records programs that ran.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Chain of custody
- Documented record of evidence handling from collection to court.
- Order of volatility
- Collect the most short-lived evidence (memory) first.
- Super-timeline
- Combined chronological view of all artifacts from a system.
- Prefetch
- Windows artifact recording program execution.
- $MFT
- NTFS Master File Table holding metadata for every file.
- Write blocker
- Device preventing changes to evidence media during imaging.
See the full cyber security glossary →
Official references
Related courses
Security Operations & Incident Response
SIEM, detection engineering, triage, the IR lifecycle and writing a useful post-incident review.
Threat Intelligence & MITRE ATT&CK
Intelligence lifecycle, ATT&CK mapping, IOCs vs TTPs and turning news into defensive action.
Endpoint Security & Malware Analysis
Hardening, EDR, forensics basics and safe static triage of suspicious files.