Search the reference library

Browse the sections below if search is unavailable.

Browse without search

• Tools

  Choose a tool by the evidence it can inspect, then validate the result on a known input.

• Techniques

  Recognize interference with evidence without mistaking ordinary system behavior for intent.

• Artifacts

  Understand what records can establish, where context is lost, and what to compare next.

• Field guides

  Plan preservation, acquisition checks, corroboration, and reporting as one defensible workflow.

• Cases

  Read documented incidents through the original report and separate observations from interpretation.

• Research

  Design repeatable tests and evaluate the limits of forensic methods and synthetic evidence.

• Downloads

  Use versioned evidence logs, validation worksheets, and review checklists with file checksums.

• Glossary

  Resolve terms that sound interchangeable but support different evidentiary claims.

• Projects

  Find verified original source repositories and distinguish source inspection from tool validation.

Curated field manual and blog links

• Evidence Integrity

  Existing wiki resource; link checked 2026-10-22.

• Windows Defender Logs

  Existing wiki resource; link checked 2026-10-22.

• UserAssist

  Existing wiki resource; link checked 2026-10-22.

• Time Zone Normalization

  Existing wiki resource; link checked 2026-10-22.

• Slack Space

  Existing wiki resource; link checked 2026-10-22.

• Registry Hives

  Existing wiki resource; link checked 2026-10-22.

• Hash Verification

  Existing wiki resource; link checked 2026-10-22.

• Artifact Corroboration

  Existing wiki resource; link checked 2026-10-22.

• Intent Analysis Limits

  Existing wiki resource; link checked 2026-10-22.

• Evidence Preservation

  Existing wiki resource; link checked 2026-10-22.

• Chain of Custody

  Existing wiki resource; link checked 2026-10-22.

• Windows Prefetch

  Existing wiki resource; link checked 2026-10-22.

• Shellbags

  Existing wiki resource; link checked 2026-10-22.

• SSD TRIM

  Existing wiki resource; link checked 2026-10-22.

• Report Review

  Existing wiki resource; link checked 2026-10-22.

• Forensic Imaging

  Existing wiki resource; link checked 2026-10-22.

• Log Gaps

  Existing wiki resource; link checked 2026-10-22.

• Timestamp Manipulation

  Existing wiki resource; link checked 2026-10-22.

• Hibernation and browsing evidence

  Existing blog resource; link checked 2026-10-22.

• Disk wiping: historical discussion

  Existing blog resource; link checked 2026-10-22.

• Reading the Notepad tab cache

  Existing blog resource; link checked 2026-10-22.

• AES example: historical source code

  Existing blog resource; link checked 2026-10-22.

• Linux file wiping: historical discussion

  Existing blog resource; link checked 2026-10-22.

• Digital Evidence

  Existing wiki resource; link checked 2026-10-22.

• Evidence Packaging

  Existing wiki resource; link checked 2026-10-22.

• Evidence Transfer

  Existing wiki resource; link checked 2026-10-22.

• Write Blocking

  Existing wiki resource; link checked 2026-10-22.

• Forensic Triage

  Existing wiki resource; link checked 2026-10-22.

• Live Response

  Existing wiki resource; link checked 2026-10-22.

• Volatile Data

  Existing wiki resource; link checked 2026-10-22.

• Working Copies

  Existing wiki resource; link checked 2026-10-22.

• Collection Bias

  Existing wiki resource; link checked 2026-10-22.

• False Positives

  Existing wiki resource; link checked 2026-10-22.

• False Negatives

  Existing wiki resource; link checked 2026-10-22.

• User Attribution

  Existing wiki resource; link checked 2026-10-22.

• Source Attribution

  Existing wiki resource; link checked 2026-10-22.

• Parser Validation

  Existing wiki resource; link checked 2026-10-22.

• Tool Verification

  Existing wiki resource; link checked 2026-10-22.

• Repeatability

  Existing wiki resource; link checked 2026-10-22.

• Scope Control

  Existing wiki resource; link checked 2026-10-22.

• File Carving

  Existing wiki resource; link checked 2026-10-22.

• Carving False Positives

  Existing wiki resource; link checked 2026-10-22.

• File Signatures

  Existing wiki resource; link checked 2026-10-22.

• Data Remanence

  Existing wiki resource; link checked 2026-10-22.

• Unallocated Space

  Existing wiki resource; link checked 2026-10-22.

• File Fragmentation

  Existing wiki resource; link checked 2026-10-22.

• File System Timestamps

  Existing wiki resource; link checked 2026-10-22.

• Master File Table

  Existing wiki resource; link checked 2026-10-22.

• USN Journal

  Existing wiki resource; link checked 2026-10-22.

• APFS Snapshots

  Existing wiki resource; link checked 2026-10-22.

• Windows Event Logs

  Existing wiki resource; link checked 2026-10-22.

• PowerShell Logs

  Existing wiki resource; link checked 2026-10-22.

• Browser History

  Existing wiki resource; link checked 2026-10-22.

• Browser Cache

  Existing wiki resource; link checked 2026-10-22.

• Browser Downloads

  Existing wiki resource; link checked 2026-10-22.

• SQLite App Databases

  Existing wiki resource; link checked 2026-10-22.

• Cross-Device Sync

  Existing wiki resource; link checked 2026-10-22.

• Cloud Audit Logs

  Existing wiki resource; link checked 2026-10-22.

• Cloud Export Files

  Existing wiki resource; link checked 2026-10-22.

• OAuth Application Grants

  Existing wiki resource; link checked 2026-10-22.

• iOS Backups

  Existing wiki resource; link checked 2026-10-22.

• iOS Backup Manifest

  Existing wiki resource; link checked 2026-10-22.

• Android App Data

  Existing wiki resource; link checked 2026-10-22.

• Mobile Photo Metadata

  Existing wiki resource; link checked 2026-10-22.

• Bash History

  Existing wiki resource; link checked 2026-10-22.

• Linux auditd

  Existing wiki resource; link checked 2026-10-22.

• systemd Journal

  Existing wiki resource; link checked 2026-10-22.

• macOS Unified Logs

  Existing wiki resource; link checked 2026-10-22.

• FSEvents

  Existing wiki resource; link checked 2026-10-22.

• Quarantine Events

  Existing wiki resource; link checked 2026-10-22.

• Time Machine Backups

  Existing wiki resource; link checked 2026-10-22.

• Memory Acquisition

  Existing wiki resource; link checked 2026-10-22.

• Memory Images

  Existing wiki resource; link checked 2026-10-22.

• Process Trees

  Existing wiki resource; link checked 2026-10-22.

• Network Sockets in Memory

  Existing wiki resource; link checked 2026-10-22.

• Indicators of Compromise

  Existing wiki resource; link checked 2026-10-22.

• Sigma Rules

  Existing wiki resource; link checked 2026-10-22.

• YARA Rules

  Existing wiki resource; link checked 2026-10-22.

• EDR Case Exports

  Existing wiki resource; link checked 2026-10-22.

• Containment Notes

  Existing wiki resource; link checked 2026-10-22.

• Incident Handoff

  Existing wiki resource; link checked 2026-10-22.

• First Response Checklist

  Existing wiki resource; link checked 2026-10-22.

• Cloud Evidence Checklist

  Existing wiki resource; link checked 2026-10-22.

• Mobile Evidence Checklist

  Existing wiki resource; link checked 2026-10-22.

• Tool Validation Checklist

  Existing wiki resource; link checked 2026-10-22.

• Timeline Review Checklist

  Existing wiki resource; link checked 2026-10-22.

• Peer Review Checklist

  Existing wiki resource; link checked 2026-10-22.

• Evidence Destruction Claims

  Existing wiki resource; link checked 2026-10-22.

• Recovery Failure

  Existing wiki resource; link checked 2026-10-22.

• Metadata Manipulation

  Existing wiki resource; link checked 2026-10-22.

• Privacy Tool Artifacts

  Existing wiki resource; link checked 2026-10-22.

• Encryption in Investigations

  Existing wiki resource; link checked 2026-10-22.

• Benign Explanations in Anti-Forensics

  Existing wiki resource; link checked 2026-10-22.