Footprint (Forensic)
In network forensics, the **footprint** is the impact an investigator leaves on the systems under examination. Every interaction with a live system modifies it in some way—just as…
#investigation
5 published notes
Baseline in Digital Forensics
# Baseline in Digital Forensics A **baseline** is a captured snapshot of a system's normal state under known-good conditions. It records what processes, services, network connect…
Hypothesis-Driven Analytical Investigation
In forensic and analytical work, thinking is not enough. You must build a **testable chain** between your ideas and the evidence. ## The core loop 1. **Observe** — Notice someth…
Convergent vs Divergent Thinking in DFIR
# Convergent vs Divergent Thinking in DFIR These two thinking modes are the mental engine behind every good investigation. ## Divergent thinking Cast a wide net. You do not know…
Get-Member CmdLet
# Get-Member CmdLet `Get-Member` is a PowerShell discovery CmdLet that reveals the **members** (properties, methods, events, and other object attributes) of any object piped into…