Tools
Choose a tool by the evidence it can inspect, then validate the result on a known input.
Reference Library · Read • Investigate • Corroborate
Reference Library
A practical route from an evidence question to the records, tools, and limits that can support an answer.
Start with the question
Choose a route through sources, acquisition, corroboration, and limits. The library connects original guides to the existing field manual and blog; it does not replace either collection.
Investigators · Is this record enough to support the claim?
Start with Evidence Integrity, preserve the source, and trace the observation back to its collection. Compare independent artifacts. An account identifier alone does not establish a human actor.
DFIR responders · What must be preserved before records expire?
Use acquisition verification, Evidence Preservation, and the evidence log. Record volatility, access limits, and collection-induced changes.
Students · How do an artifact and an inference differ?
Read the glossary, examine the artifact index, then follow Artifact Corroboration. Explain an ordinary competing cause before assigning intent.
Report reviewers · What does a timestamp or missing log prove?
Read timeline corroboration and Security log clear records. Compare Time Zone Normalization and Log Gaps.
Researchers · How can this method be tested?
Use a bounded validation protocol and NIST’s tool-testing program. Preserve the input, expected result, tool version, and failures.
Browse the reference
Techniques
Recognize interference with evidence without mistaking ordinary system behavior for intent.
Artifacts
Understand what records can establish, where context is lost, and what to compare next.
Field guides
Plan preservation, acquisition checks, corroboration, and reporting as one defensible workflow.
Cases
Read documented incidents through the original report and separate observations from interpretation.
Research
Design repeatable tests and evaluate the limits of forensic methods and synthetic evidence.
Downloads
Use versioned evidence logs, validation worksheets, and review checklists with file checksums.
Glossary
Resolve terms that sound interchangeable but support different evidentiary claims.
Projects
Find verified original source repositories and distinguish source inspection from tool validation.
Three useful investigations
- Was the Security log cleared?
Interpret the record, compare remote copies, and test ordinary administrative explanations.
- Do these events actually line up?
Keep raw times and clock uncertainty connected to each event.
- What supports the origin of this media?
Distinguish provenance assertions, generated content, and detector output.
48Detailed references
12Tool profiles
76Defined terms
20Working templates
Choose an evidence question
Explore the evidence-question routes to connect source conditions, competing explanations and the next useful check.
Find an artifact by name
Browse hiberfil.sys, Notepad cache, UserAssist, Defender logs and other evidence topics to connect familiar terms with the next useful interpretation question.