Digital Forensics – The Importance of Forensic Triage Images
summary
Argues that a targeted forensic triage image plus memory snapshot answers most incidents — “more than nine times out of ten” — and recommends to collect memory first because of volatility. Lists Windows artifacts to grab (MFT, USN journal, Prefetch, Jump Lists, link files, registry hives, SRUM, event logs) and tools that actually work: CAPE (cartifact parser and extractor), Belkasoft RAM Capture, Velociraptor, CrowdStrike real‑time responder, FTK Imager/EnCase. Shows a real example: 2.7 GB from a 500 GB drive for fast analysis.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:06About Cyber Florida
- 2:31Talk objectives
- 3:34What is forensic triage
- 4:36Why triage images matter
- 6:44Memory forensics importance
- 8:09Windows artifacts starter kit
- 13:31Registry hives and journal files
- 17:03Free forensic artifact posters
- 18:09Enterprise forensic tools
- 20:59Cape tool overview
- 23:49CrowdStrike workflow
- 25:12Working with tight budgets
- 26:58Belkasoft RAM capture
- 27:18Velociraptor for scale
- 31:31Why triage images work
- 36:50Insider threat scenarios
- 42:48Forensically sound evidence
- 44:55Timing and evidence degradation
related talks
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
31mBringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
33mSpeed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing
01h 03mInvestigating Malware Using Memory Forensics - A Practical Approach
31mDiamonds are a Forensicator's Best Friend - Intelligence Support for DFIR
43mSocial Forensication: A Multidisciplinary Approach to Successful Social Engineering
37mDynamic Image Scanning Through System Tracing