Roxiun/DFIR.md

## DFIR.md

      
    Raw
  

              DFIR.md
            
          
    DFIR CTF

What is it?

Digital Forensics and Incident Response
Where is it found

The primary competition we have done with lots of DFIR problems is WACTF.
DEFCON DFIR and Otter CTF are both good places to practice DFIR problems.
Tools Required

All OSes


Autopsy - Disk Images (Eg. .img)
Volatility - Memory Dumps (Eg. .mem)
RegRipper - Registry Dumps (Eg. NTUSER.dat)

Windows Only


RegRipper (GUI Version)
FTK Imager

Basic Tools Usage

Autopsy


Open Autopsy
Create New case
Open disk image file
Analyse

Volatility


Find the profile - volatility -f triage.mem imageinfo
Run the desired analysis tool using the --profile=<profile_here> flag

RegRipper

Useful Commands


Utility
Command


Get all Info
for i in $( rip -l -c | grep NTUSER.DAT | cut -d , -f1 ); do rip -p $i -r NTUSER.DAT &>> case1.txt ; done


List installed Programs
rip -p listsoft -r NTUSER.DAT
Utility	Command
Get all Info	`for i in $( rip -l -c \| grep NTUSER.DAT \| cut -d , -f1 ); do rip -p $i -r NTUSER.DAT &>> case1.txt ; done`
List installed Programs	`rip -p listsoft -r NTUSER.DAT`