Digital Forensics and Incident Response: DFIR Guide

What DFIR Is, and Is Not

Digital Forensics and Incident Response is the combined discipline of investigating cyber incidents in a way that preserves digital evidence to forensic standards while moving fast enough to support operational response. The two halves used to be separate (forensic investigators arrived after the dust settled; incident responders moved fast and broke things). Modern DFIR fuses them because incidents in 2026 cannot wait for the leisurely pace of pure forensics and pure response cannot afford to destroy evidence the business will need.

DFIR is not just digital forensics. Pure DF is artefact-centric, focused on producing court-defensible evidence from a static collection (a seized laptop, a disk image, a server). DFIR is incident-centric, focused on answering the live question 'what happened, what is happening, what should we do next, and how do we document this for downstream use' under time pressure. The skill set overlaps but is broader.

Chain of Custody: The Non-Negotiable

Chain of custody documents every action taken on every piece of evidence from first collection to final disposition. Who collected, when, from where, with what tool, what hash, who handled subsequently, for what purpose. The chain must not break. A single unattributable transfer can render the evidence inadmissible in court and unusable in an insurance dispute.

Practical implementation: every artefact gets a chain-of-custody form (paper or digital) at the moment of collection. Hash values (SHA-256 minimum) are computed at collection and verified at every transfer. Storage is access-controlled and logged. Working copies are made from the original; analysis happens on the copy, never the original. The original is archived in tamper-evident storage. Codesecure templates ship with the IR engagement; they integrate with the customer's case management system if one exists, otherwise live in a controlled SharePoint or Confluence space dedicated to the incident.

Volatile vs Non-Volatile Evidence

Order of volatility, derived from RFC 3227 and continuously updated in DFIR practice: collect what disappears fastest first. CPU registers and cache (essentially impossible to capture forensically), routing tables and ARP cache, kernel-level state, running processes and open files, memory (RAM dump), network state (active connections, listening ports), then non-volatile storage (disk images, file system, registry), then archival storage (backups, cloud snapshots, logs in central SIEM).

Memory Forensics

Memory dumps capture in-memory secrets, attacker tooling, network connection state, decrypted data, browser session tokens, and processes that are not visible to disk-only collection. Capture with Magnet RAM Capture, FTK Imager, WinPmem, LiME (Linux), MacQuisition (macOS), or programmatically via Velociraptor. Analysis with Volatility 3 (the current version, Python 3, modern symbol support) and increasingly MemProcFS for filesystem-style memory analysis. Common findings: hidden processes, injected DLLs, suspicious parent-child process relationships, network connections to known C2 IPs, in-memory credentials.

Disk and Filesystem

Full disk imaging where time permits and disk size is manageable. For terabyte-scale systems, targeted collection using KAPE (Kroll Artefact Parser and Extractor) or Velociraptor offloads only the high-value artefacts (registry hives, event logs, prefetch, scheduled tasks, browser history, MFT, USN journal) in a fraction of the time. Analysis with Autopsy, X-Ways Forensics, FTK, EnCase, or open-source tooling like log2timeline (plaso) for unified timeline construction.

Log Analysis and Telemetry

Endpoint, network, application and cloud logs are often more useful than disk images because they reveal lateral movement, exfiltration patterns and attacker behaviour over time. The DFIR engagement pulls and analyses logs from: SIEM (Splunk, Sentinel, Elastic, Sumo Logic, Chronicle, QRadar), EDR (CrowdStrike Falcon, SentinelOne, Defender for Endpoint, Cortex XDR, FireEye HX), firewall and proxy, DNS, DHCP, Active Directory (security event log, sysmon if deployed), cloud (CloudTrail, Azure Activity Log, GCP Audit Logs), email gateway, authentication systems (Okta, Azure AD, on-prem IdP).

Timeline reconstruction is the central output. The DFIR analyst correlates events across sources to produce a chronological narrative: at T0, phishing email delivered; at T+2h, credential captured; at T+18h, initial endpoint compromise; at T+48h, lateral movement to file server; at T+72h, mass file encryption. The timeline drives root-cause understanding, control gap identification, and post-incident hardening priorities.

Malware Triage and Reverse Engineering

Suspicious binaries recovered from compromised systems are analysed to determine functionality, capabilities, command-and-control infrastructure, persistence mechanisms and indicators of compromise. Static analysis (file properties, strings, imports, PE/ELF/Mach-O structure) with PEStudio, exiftool, capa, YARA rule matching, and online resources like VirusTotal (carefully, since uploads are public).

Dynamic analysis in a sandbox (CAPE Sandbox, Cuckoo, ANY.RUN, Joe Sandbox, Hatching Triage, commercial offerings like FireEye AX). Observe behaviour: file system writes, registry changes, network connections, process injection, persistence creation. For deeper reverse engineering, IDA Pro, Ghidra, Binary Ninja and x64dbg cover most needs. GREM-certified consultants on the Codesecure team handle the hard cases.

Output: indicators of compromise (IOCs) including file hashes, C2 domains and IPs, mutex names, registry keys, file paths, network signatures. These feed back into SIEM and EDR for retroactive hunting across the estate.

Velociraptor: Live Triage at Scale

Velociraptor (open source, Rapid7-sponsored development) is the leading endpoint visibility and DFIR collection tool for incidents involving more than a handful of hosts. It deploys as a lightweight agent, supports query-based artefact collection from thousands of endpoints simultaneously, and includes built-in artefact libraries for Windows, Linux and macOS forensic collection.

Typical Codesecure deployment in a ransomware engagement: Velociraptor server stood up in the customer's environment within 1 to 2 hours, agents pushed to 500 to 5000 endpoints in the next 2 to 6 hours, parallel collection of memory dumps, KAPE-equivalent targeted artefact bundles, scheduled task enumeration, persistence mechanism enumeration, and live process enumeration. The result is faster scoping, faster hunting, and faster confirmation that recovery is complete.

DFIR Report Writing: Multiple Audiences

The same investigation produces several reports. Each is structured for a specific audience and purpose.

Executive summary for the Board and CEO: 2 to 4 pages, plain English, what happened, what was done, what changed, what to expect next. Technical report for the security team: 50 to 200 pages, full timeline, evidence inventory, IOCs, attacker TTPs mapped to MITRE ATT&CK, root cause analysis, prioritised recommendations. Regulator notification packs for CERT-In, RBI, SEBI, DPDP Board, NCIIPC, sector-specific bodies, each formatted to the regulator's expected fields. Insurance claim narrative with timeline, control inventory, costs incurred, business interruption analysis, and the evidence references the insurer's adjuster will need. Court-exhibit format if law enforcement is involved or civil litigation is anticipated; chain of custody documentation is critical here.

Codesecure delivers all of these from a single DFIR engagement. The same investigation, packaged five ways. This is what separates a real DFIR engagement from a SOC writeup.