DFIR notebooks GCIH Gold project, paper
HTML Other
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
code
examples
logo
paper_img
rsrc
.gitattributes
.gitignore
LICENSE.txt
README.md
dfirnotes-BSK-DRAFT.doc
dfirnotes-BSK-DRAFT.txt
win5mem-jupyter.ipynb

README.md

dfirnotes

GIAC Gold project & paper: paper draft, examples, scripts, resources

Paper Abstract

Free and open source scientific notebook software allows responders to perform analysis and record results simultaneously in an open, flexible, portable format for ease of sharing and reporting. Fully worked samples can improve analyst and responder mentoring and education. Use of notebook templates can encourage good practices, uphold standards, and improve investigative rigor for better DFIR science and better incident response. Suggested configuration options and server platform notes for SIFT3 explain notebook setup for forensics. The proposed workflow and methodology show how DFIR process and techniques are integrated into notebooks and SIFT server environment and a walk through a sample investigation in notebooks illustrates the advantages.

Files

  • Paper draft in DOC, txt
  • example notebooks:
    • win5mem : Volatility memory analysis of WinXP: template, completed, slides
    • Rekall demo notebook of @tekdefense Dark Comet analysis, with Jupyter slides
  • logos, from openclipart.org originals, Inkscape
  • paper graphs and images, full size & crops
  • python samples :
    • pscsv.py: Volatility process list with csv output
    • install, new case scripts
  • resources: Articles and conference presentations

License

Original works including paper, scripts, sample notebooks copyleft 2015 @adricnet and available for distribution and reuse under MIT license.

Products including @ipython GitHub, @sans-dfir SIFT3 available under their own licenses.