DFIR Lab

Reproducible digital forensics labs, acquisition notes, and timeline-analysis references.

The lab favors evidence integrity, explicit assumptions, and repeatable analysis over tool-driven conclusions.

Principles

1. Preserve original evidence and analyze verified working copies.
2. Record acquisition context, timestamps, tool versions, and hashes.
3. Keep facts, analyst inference, and unanswered questions separate.
4. Use synthetic or intentionally published datasets only.
5. Never commit real case evidence, personal data, secrets, or client identifiers.

Labs

Lab	Objective	Status
Windows event triage	Build a defensible first-pass timeline from Windows event logs	Specification v0.1

Templates

• Case notes

This repository is educational and defensive. Adapt collection procedures to the legal authority, evidence policy, and environment governing the investigation.

_{QA3 · DIGITAL FORENSICS · QA3.ME}