DFIR Checklists

• 🥒 Preparation
  • 📝 Compile a list of all your assets (servers, networks, applications etc.)
  • 📈 Rank them by the level of importance.
  • 👁 Monitor their traffic patterns and create baselines.
  • 🫂 Create a communication plan (who to contact, how, and when based on each incident type). Incident Handler Communications and Facilities (contacts, on-call info, reporting mechanism, issue tracking, smartphones, encryption soft, war room, secure storage).
  • 🚧 Determine which security events and at what thresholds should be investigated.
  • 📖 Create one incident response plan and playbooks for each type of incident that are most likely to happen or can inflict the most damage.
  • 📖 Create an Incident Response Policy.
• Identification (🔬🧪 DF *)
  • 🚨 Discover. Discovery and classification (Where is the sensitive data?), Entitlements reporting (Who can access), Vulnerability Assessment (How to secure it?).
  • 🔎 Investigate.
  • ⛓ Harden. Reconfigure, mask, encrypt (How to protect sensitive data?)
  • 👀 🗡 Monitor and Protect. Activity monitoring, Blocking quarantine, dynamic data masking
  • Repeat.
• Containment (🔬🧪 DF *)
• Eradication (🔬🧪 DF *)
• Recovery (🔬🧪 DF *)
• Lessons Learnt (🔬🧪 DF *)

🔬🧪 Digital Forensics process can take place at any stage of the incident response process.

• 🤔 Identification/Assessment (aka Preparation)
  • Define scope
  • Sterilise the target media (more here)
• 🧹 Collection
  • 🏃🏼 First response
    • Sanitise the target disk that will be used to copy evidence to
    • Prepare all the toolkits that will be needed.
    • Start filling out the Chain of Custody form; each piece of evidence is assigned a unique ID (see below for examples).
    • All photos were taken before touching the scene.
    • Ensure that the Internet, Bluetooth, and AirDrop are all turned off on the machine used to acquire the image (* in case of physical acquisition).
    • Connect the write blocker to the PC, and the evidence drive to the write blocker (power + data cables) or launch a software write blocker on the acquirer machine (see below for how-to) (* in case of physical acquisition).
    • Calculate the hash of the evidence drive (pre-hash). Document it.
    • Image the evidence.
    • Calculate the hash of the original evidence again, validate the hash and document it.
    • Calculate the **hash of the image taken (post-hash) and ensure it matches the above ones taken previously.
  • 🤏🏼 Acquisition (live or dead).
    • Physical storage. Mind the order of volatility, see RFC here.
      • Cache, registers (CPU). 🛠 Debuggers (OllyDbg, gdb, x64dbg etc)
      • ARoTa MeKSaPTa. ARP cache, routing table, memory, kernel statistics, process table. Mnemonics: ARoTa MeKSaPTa
        • Routing tables. Contain the following info: destination IP addresses or networks; the gateway IP address, or interface name if a directly connected resource; the metric, or cost, associated with the route – this enables the most efficient route to be selected; the outgoing interface the machine will use when forwarding a packet.
          • Windows route print
          • UNIX netstat -rn
        • ARP cache: arp -a
        • Process table. The list of processes currently running + metadata.
          • UNIX ps
          • Windows. Task Manager (GUI) or tasklist (-> csv).
        • Kernel stats. 🛠 RAMMap, part of the Sysinternals suite for Windows, and memmap in the Linux world. Tracks the page usage (physical RAM chunks), mappings of those pages.
      • Temporary files. Malware likes these folders because it’s often already full of garbage.
        • Linux /tmp.
        • swap (UNIX)
        • pagefile (Windows)
      • Disk.
      • Logs. Monitoring data and remote logging pertaining to the computer in question. SIEMs and other log storages.
      • Physical configurations, network topology.
      • Archival media. CDs, backups, USBs.
    • Logical backup
  • 🗳 Evidence Preservation
    • Copy original, operate on the copy.
    • Calculate hashes at each stage (unless it’s cloud evidence)
    • Use hardware write-blockers or software write-blockers
    • Make sure min number of files is created.
    • Register timestamps before opening files.
  • 📇 Documentation.
• 🔬🧪 Examination & Analysis
  • 🦠 Malicious Process
    • Network
    • Files
    • Processes
  • 👥 User
    • Is there malicious user activity (account takeover, insider threat)?
  • ⚙️ OS Configs
    • Are there mal configs (services enabled, disabled logging)?
  • 🗜 Hardware
    • Are there mal hardware changes (firmware, BIOS)?

• A PC technician’s toolkit 🧰 (screwdrivers 🪛, squeezers, scissors✂️, portable batteries 🔋, etc.) to be able to remove HDD, lockdown cables etc.) ✅
• Digital camera 📸 that embeds timestamps on the photos. 📝 Take photos; the more, the better!
• Video camera 📹. 📝 Take a video; the longer, the better.
• For labelling and documenting (labels, markers, pens, 🖊, evidence tape 🚧).
• They are transporting and managing evidence 💼 (Faraday bag, Anti-static bag, evidence log, large envelopes ✉️, gloves🧤, sanitiser).
• Documents (chain of custody, notes 🗒, warrants/subpoenas).
• Digital forensics specifics (forensics software, write blockers, laptop 💻, sterilise target media, flash drives for live/dead acquisition, bootable, Apple USB Type-C wires).