Digital Forensics Analysis (Foundations) · Hacking Project

Enable a student to conduct a forensically sound investigation from evidence acquisition through analysis to a defensible report.

**The problem**
After a security incident, organizations must reconstruct what happened, preserve evidence defensibly, and answer who/what/when — yet many teams lack sound forensic methodology and contaminate evidence. Improper acquisition or broken chain-of-custody can render findings inadmissible and hinder incident response. Foundational DFIR skills are scarce relative to demand.

**What you'll build**
Build a digital forensics workflow covering forensically sound acquisition (imaging with hashing), analysis of disk and memory artifacts (Autopsy, Volatility, Sleuth Kit), timeline reconstruction, and reporting with preserved chain-of-custody. Investigate a simulated incident to recover deleted files, browser/registry artifacts, and memory-resident indicators. The output is a court-ready-style investigative report following NIST 800-86 guidance.

**Objective** — Enable a student to conduct a forensically sound investigation from evidence acquisition through analysis to a defensible report.

**Expected outcome** — A complete forensic case report with verified evidence hashes, artifact timeline, memory/disk findings, and documented chain-of-custody.

**Difficulty** — Beginner — foundational with guided casework, though memory forensics and anti-forensics push to Intermediate.

**Primary category** — DFIR; Secondary = Incident Response, Malware Analysis, SOC

**Security domains** — Primary = Digital Forensics; Secondary = Incident Response, Blue Team, Malware Analysis, Threat Intelligence

**Technical focus** — Forensic imaging/acquisition, hashing/integrity, disk forensics, memory forensics, timeline analysis, registry/browser artifacts, file carving, chain-of-custody, anti-forensics awareness, reporting

**Core technologies** — Languages: Python, Bash; Frameworks/Libraries: Volatility 3, plaso/log2timeline; Security Tools: Autopsy, The Sleuth Kit, FTK Imager, Volatility, Wireshark; Cloud/Infra: isolated forensic VM/workstation, write blockers (concept); AI/Data: optional artifact anomaly detection; Databases: SQLite (artifact stores, browser DBs)

**Where it's valued** — Law enforcement, DFIR consultancies, MSSPs, finance, healthcare, legal/eDiscovery, government

**Careers it builds toward** — Digital Forensics Analyst, Incident Responder, DFIR Consultant, SOC Analyst, Malware Analyst

**Framework alignment**
• MITRE ATT&CK: Post-incident analysis of Defense Evasion — Indicator Removal (T1070), Timestomp (T1070.006); Persistence and Execution artifact discovery; supports detection validation across tactics
• NIST CSF 2.0: Respond (Analysis, Forensics), Recover, Detect; aligns to NIST SP 800-86 forensic process
• OWASP: N/A (host/artifact forensics focus)
• CIS Controls v8: 8 (Audit Log Management), 17 (Incident Response Management)

**Innovation** — Existing Idea — a foundational DFIR exercise; value is in rigorous methodology and defensible reporting rather than novelty. Scores: Innovation 4/10, Startup 3/10, Enterprise-Readiness 5/10, Patent = No.