Library and Threat Feed site map

Reference and original guides

• Reference Library

  A practical route from an evidence question to the records, tools, and limits that can support an answer.

• Digital evidence topics and artifact finder

  Find hiberfil.sys, Notepad cache, UserAssist, Defender logs, registry hives and evidence-integrity guides by the artifact or question you have.

• Tools

  Choose a tool by the evidence it can inspect, then validate the result on a known input.

• Techniques

  Recognize interference with evidence without mistaking ordinary system behavior for intent.

• Artifacts

  Understand what records can establish, where context is lost, and what to compare next.

• Field guides

  Plan preservation, acquisition checks, corroboration, and reporting as one defensible workflow.

• Cases

  Read documented incidents through the original report and separate observations from interpretation.

• Research

  Design repeatable tests and evaluate the limits of forensic methods and synthetic evidence.

• Downloads

  Use versioned evidence logs, validation worksheets, and review checklists with file checksums.

• Glossary

  Resolve terms that sound interchangeable but support different evidentiary claims.

• Projects

  Find verified original source repositories and distinguish source inspection from tool validation.

• Evidence-question pathways

  Connect an investigative question to source conditions, corroboration, interpretation limits, and working records.

• What a Windows Security log clear record establishes

  Interpret Event 1102 without turning an account record into a claim about intent.

• Verify an acquisition and its working copies

  Connect scope, acquisition records, hash comparisons, and transfers to the claim you need to support.

• Corroborate a timeline without flattening uncertainty

  Keep original times, offsets, clock context, and independent observations linked.

• Review a forensic claim from conclusion back to source

  Separate the observation, method, interpretation, and limits before accepting a report’s conclusion.

• Design a small forensic validation study

  Use known inputs, discriminating controls, and a reproducible record to test one bounded claim.

• Provenance, detector scores, and the limits of an origin claim

  Distinguish a recorded history from a statistical signal and from proof of authenticity.

• Read a Linux journal gap in its boot and storage context

  Compare journal storage, boot identity, filtering, and collection before interpreting missing Linux events.

• Investigate Windows forwarding gaps across the collection path

  Distinguish event generation, subscription selection, delivery, storage, and search visibility.

• Interpret NTFS change records without inventing a complete history

  Use journal identifiers, reason flags, file references, and independent records to bound a change claim.

• Preserve browser SQLite databases with their transaction context

  Separate a consistent logical database from a preserved source collection, and keep WAL-related limitations visible.

• Bound cloud audit findings by event coverage and credential identity

  Use AWS CloudTrail as a concrete model for account, region, event category, retention, and attribution limits.

• Separate container output, node records, and Kubernetes audit events

  Reconstruct a workload with stable identifiers and the actual logging architecture rather than one command’s output.

• State what a mobile backup or logical export leaves outside scope

  Distinguish device content, backup eligibility, synchronized services, and the particular collection product.

• Explain failed recovery without claiming deliberate destruction

  Separate searched bytes, filesystem allocation, storage behavior, and recovery-method limits.

• Review metadata inconsistencies across a file’s transformations

  Compare filesystem, embedded, service, and collection metadata without assuming every difference is tampering.

• Create a provenance record that survives export and review

  Make every significant object traceable to its source, acquisition, transformations, and analytical use.

• Verify a cloud export beyond its download checksum

  Connect service scope, export jobs, native verification records, pagination, and local integrity checks.

• Account for changes caused by live response

  Record what a collection action could change and distinguish expected effects from observed effects.

• Review negative evidence before saying an event did not happen

  Test the path from expected record generation to the analyst’s search result.

• Resolve disagreement between forensic tools

  Reduce a conflict to a specific input, transformation, field, and interpretation.

• Design a blinded validation with inspectable ground truth

  Separate dataset construction, expected answers, examiner exposure, and adjudication.

• Read sampling and error rates without losing the denominator

  Distinguish false-positive rate, precision, repeated trials, and operational prevalence.

• Package a reproducible forensic research bundle

  Make the input-to-conclusion path reviewable without exposing protected case data.

• Report uncertainty where it affects the conclusion

  Connect source gaps, method limits, and competing explanations to specific findings.

• Compare vendor incident claims without merging their visibility

  Distinguish telemetry, sample analysis, hypotheses, product claims, and subsequent corrections.

• Preserve the workflow around synthetic media

  Connect received media, service exports, prompts, edits, and provenance without collapsing their roles.

• NotPetya: analyze documented log loss without inventing the missing history

  A historical reading of Microsoft’s June 2017 report and the investigative limits of local gaps.

• SolarWinds: separate a valid signature from a trustworthy build

  A historical analysis of Microsoft’s compromised-DLL report and the boundary of signature evidence.

• The Sleuth Kit: scope, evidence, and limits

  Which filesystem record supports the recovered name or content?

• Autopsy: scope, evidence, and limits

  Did a displayed result come from a native record, an ingest module, or an analyst annotation?

• Volatility 3: scope, evidence, and limits

  What was actually present in this acquisition, and what did the plugin infer from it?

• Plaso: scope, evidence, and limits

  What source event does this normalized timestamp describe?

• Timesketch: scope, evidence, and limits

  Which parts of this timeline are source facts and which are analyst-created context?

• Velociraptor: scope, evidence, and limits

  What did the collection query ask the endpoint to produce?

• Hayabusa: scope, evidence, and limits

  Does this rule match identify suspicious behavior, or merely a pattern worth checking?

• Chainsaw: scope, evidence, and limits

  Can the matched fields be traced back to the original record?

• osquery: scope, evidence, and limits

  Is this a current-state observation or a retained event record?

• ExifTool: scope, evidence, and limits

  Which metadata container produced this value, and how does it relate to the file?

• Wireshark: scope, evidence, and limits

  What was captured at this observation point, rather than what happened everywhere on the network?

• SQLite command-line shell: scope, evidence, and limits

  Does the examined database state include the transactions relevant to this collection?

• Hiberfil.sys, pagefile, and live memory: three different browsing questions

  Interpret browser-related remnants with their power-state, collection, time, and attribution limits.

• Notepad tab state and saved files answer different recovery questions

  Connect recovered session content to its source without assuming it was saved, transmitted, or written by a particular person.

• Compare UserAssist, BAM, DAM, Prefetch, and SRUM by the question they answer

  Separate shell activity, moderation records, launch-related traces, and resource usage before combining them into execution evidence.

• Read Microsoft Defender logs as product observations with collection limits

  Separate detection, action, failure, configuration, and retained evidence before assessing an incident.

• Evidence integrity, authenticity, completeness, and chain of custody

  Use four separate questions to explain what a hash comparison and a handling record actually establish.

• Registry hives: NTUSER.DAT, SYSTEM, SOFTWARE, and transaction context

  Distinguish profile and machine context, preserve companion files, and avoid turning a key timestamp into a user-action history.

• Review storage recovery claims: slack, unallocated space, and SSD TRIM

  Evaluate what was searched and what the storage interface exposed before accepting a recoverability or overwrite claim.

• Login history, logon sessions, and the limits of user attribution

  Distinguish an account’s authentication records from a session, resource use, and evidence identifying a human operator.

• About this library

  A curated entry layer for Anti-Forensics.com, connecting evidence questions to original sources and careful interpretation.

• Research standards, sources, and corrections

  Distinguish documented behavior, publisher claims, interpretation, and untested hypotheses.

Threat Feed

• Forensic Integrity Threat Feed

  Original-source signals about evidence availability, log visibility, forensic methods and investigative reliability.

• Threat Feed topics and boundaries

  Use the documented evidentiary consequence to distinguish direct relevance from general security news.

• Threat Feed methodology

  A conservative selection process with exact-source approvals, honest date precision, immutable versions and failure retention.

• Threat Feed source catalog

  Inspect the original endpoints, actual adapter scope, rights notes and collection states.

• Selection snapshot · 2026-10-22 · 3e746b37bf

  An immutable selection snapshot: original publication dates remain attached to each source record.

• Selection snapshot · 2026-10-22

  An immutable selection snapshot: original publication dates remain attached to each source record.

• Threat Feed archive

  Browse dated, indexable HTML snapshots of previously published Threat Feed selections.

• Threat Feed publication versions

  Inspect current and superseded public records, including source digests and editorial annotations.

• Threat Feed data and exports

  Download the bounded selection, source manifest, RSS and immutable record versions with documented date precision.

Existing publications

WordPress blog · DokuWiki field manual