Command Center · Reference 05
Forensics Quick Reference
Fast evidence-first lookup for preservation, hashing, accounts, logs, processes, services, scheduled activity, network connections, browser artifacts, suspicious files, and timelines.
Start with the question, choose the right source, preserve useful evidence, corroborate, and answer only what the evidence supports.
Evidence Rule
Before remediation
Evidence can disappear when the system changes
Processes exit, network connections close, files change, logs rotate, and scheduled tasks can be deleted. Record the details that matter before making defensive changes.
Forensics
Evidence Preservation
Capture paths, timestamps, hashes, PIDs, accounts, log entries, scheduled-task details, and network state before remediation.
Caution
Changing the system can destroy or alter evidence.
Preserve the original evidence source and analyze a working copy.
Caution
Do not confuse a copied artifact with the original source.
Write what the evidence directly shows first, then label any interpretation separately.
Caution
A plausible explanation is not the same as proof.
Keep remediation actions separate from the original state.
Caution
This prevents later confusion when reconstructing the timeline.
Forensics
Hashes & File Identity
Calculates a SHA-256 hash on Windows.
Caution
A hash identifies content; it does not prove whether the file is safe.
Calculates a SHA-256 hash on Linux.
Caution
Hash equality means identical content, not identical origin or intent.
Identifies a Linux file by content rather than extension.
Caution
File type is useful triage evidence, not a verdict.
Shows useful Windows metadata.
Caution
Creation and write times describe different events.
Forensics
Windows Accounts & Authentication
Lists local Windows accounts.
Caution
Account presence does not prove activity.
Shows local Administrators membership.
Caution
Privilege membership is capability, not proof of use.
Shows recent Security events.
Caution
Filter by time and event ID when possible.
Filters common authentication/privilege events.
Caution
Use logon type and surrounding events for context.
Forensics
Linux Accounts & Authentication
Lists visible user accounts.
Caution
Presence alone does not indicate recent activity.
Shows UID and group membership for one account.
Caution
Group membership is capability, not action.
Shows recent login history from wtmp where available.
Caution
Historical login databases can be rotated or incomplete.
Shows recent authentication events on many Ubuntu/Mint systems.
Caution
Some systems rely more heavily on journald.
Forensics
Processes
Lists current Windows processes.
Caution
Process name alone does not establish legitimacy.
Shows PID, PPID, path, and command line on Windows.
Caution
Some fields may require elevation.
Shows detailed Linux process context.
Caution
Processes are volatile; capture useful details promptly.
Shows Linux parent-child process relationships.
Caution
Parentage helps explain execution but does not prove intent.
Forensics
Services & Startup
Shows Windows service state, startup mode, account, and executable path.
Caution
Required services can look unfamiliar.
Shows a broad Windows startup-command inventory.
Caution
It is useful but not exhaustive.
Lists running Linux services.
Caution
Running does not automatically mean required or suspicious.
Shows the effective Linux systemd unit and overrides.
Caution
Drop-in overrides can change behavior from the vendor default.
Forensics
Scheduled Tasks, Cron & Timers
Lists Windows scheduled tasks.
Caution
Configured does not mean executed.
Shows last and next run details for one task.
Caution
Pair with task action, trigger, and account.
Shows the current Linux user's crontab.
Caution
Other users and system cron locations must be checked separately.
Lists systemd timers and run timing.
Caution
Inspect the associated service unit before changing anything.
Forensics
Network Connections
Shows Windows TCP endpoints, states, and owning PIDs.
Caution
Map OwningProcess to the actual process before concluding anything.
Shows listening Windows TCP sockets.
Caution
Listening does not guarantee remote reachability.
Shows Linux listening TCP/UDP sockets and processes when permissions allow.
Caution
A port number is a clue, not proof of the service.
Shows active Linux TCP connections with process context.
Caution
Connection presence alone does not establish malicious activity.
Forensics
Browser & Download Artifacts
Can show visited URLs and timing.
Caution
Visited does not necessarily mean downloaded or executed.
Can show file names, source URLs, paths, and times.
Caution
Downloaded does not mean opened or executed.
Can add context around browsing activity.
Caution
Cache presence can be automatic and should be interpreted carefully.
Correlates the browser artifact to a specific file on disk.
Caution
File identity still does not prove user intent.
Forensics
Email & Document Triage
Compare display name with the actual sending address.
Caution
Display names are easy to imitate.
Headers can show routing, authentication, and source clues.
Caution
Headers require context and should not be reduced to one field.
Use file/content identification rather than trusting the extension.
Caution
Extensions can be misleading.
Author, timestamps, title, and application metadata can support correlation.
Caution
Metadata can be modified and should be corroborated.
Forensics
Archives, Hidden Files & Alternate Storage
Inspect filenames and structure before extracting or opening content.
Caution
Archive presence does not prove malicious intent.
Windows attributes and Linux dotfiles can reveal intentionally less-visible files.
Caution
Hidden does not mean malicious.
Lists NTFS alternate data streams where supported.
Caution
An alternate stream is not automatically suspicious.
Shows hidden Linux entries and permissions.
Caution
Interpret ownership, timestamps, and location together.
Forensics
Timeline Reconstruction
Keep original timestamps and note the time zone before comparing events.
Caution
Do not silently convert times without recording the original.
Sort by time, then label source and evidence type.
Caution
Close timestamps do not always mean direct causation.
Use logs, browser data, files, processes, scheduled activity, and network evidence together.
Caution
One source can be incomplete or misleading.
Separate high-confidence facts from reasonable inferences.
Caution
Do not present uncertain interpretation as fact.
Windows events
High-value event IDs
Windows logons
Common logon types
Timestamp guide
Do not treat every timestamp as the same event
Windows CreationTime
When the current file object was created on that volume.
Windows LastWriteTime
When file content was last written.
Linux mtime
File content modification time.
Linux atime
Last access time when tracked.
Linux ctime
Metadata-change time, not creation time.
Linux birth time
Creation-like timestamp when supported by filesystem/tools.
Evidence questions
Ask these before writing your conclusion
What exact question am I trying to answer?
Which source is most likely to contain direct evidence?
What should I preserve before touching the system?
Is this a fact, an inference, or only a possibility?
Can another independent source corroborate it?
Are the timestamps in the same time zone?
Does the account, task, service, or process merely exist, or is there evidence it actually ran?
What evidence would contradict my current explanation?
Common mistakes
Forensics mistakes that weaken the evidence
Answering from one artifact when the question requires correlation.
Treating ctime as Linux file creation time.
Assuming a downloaded file was opened or executed.
Assuming an account with privilege actually used that privilege.
Killing a process before recording path, command line, parent PID, hash, and network state.
Deleting a scheduled task before recording its action, trigger, account, and run history.
Changing timestamps or files before preserving the original evidence.
Presenting an inference as if it were a directly observed fact.