The DFIR Report
by The DFIR Report analysts · The DFIR Report
Free, detailed reconstructions of real intrusions, mostly ransomware and malware campaigns. Each report traces the attacker from initial access to impact, with timelines, event-log and memory evidence, detection rules and indicators. The site has published 85+ public reports.
More resources on Digital Forensics & Incident Analysis
SANS Hunt Evil Poster (Windows Forensic Analysis Reference)
This is a compact, trusted reference that working analysts keep at their desks. It gives some of the value of the $8k+ SANS courses at no cost. Free SANS DFIR reference poster listing the normal parent processes, paths, user accounts and instance counts of core Windows processes. Analysts use it to spot malicious or impersonated processes during memory and live-response analysis.
13Cubed (YouTube channel)
This is the best free video path into hands-on forensic work. Each episode walks through a specific artefact with real tools, which complements the theory in the books. Free DFIR video series by a Microsoft forensic investigator. It covers Windows artefacts (Prefetch, ShimCache, SRUM, jump lists), memory forensics with Volatility, Linux and macOS forensics, and timeline analysis, all shown with real tools on sample evidence.
File System Forensic Analysis
A detailed technical reference on how disk partitions and file systems (FAT, NTFS, Ext2/3, UFS) store data. This is the canonical disk-forensics text, recommended again and again in DFIR communities. File-system internals have barely changed, so the 2005 edition still serves as the reference. It shows how to recover deleted files and metadata. The author wrote The Sleuth Kit and Autopsy.
NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
This is the primary-source framework the topic note asks for (chain of custody, the collect-examine-analyse-report process). NIST's reference guide to the forensic process in incident response: collection, examination, analysis and reporting. It covers evidence handling and chain of custody, and treats files, operating systems, network traffic and applications as separate data sources. It dates from 2006, so its tool specifics are old, but the methodology still holds.
The Art of Memory Forensics
Explains how to acquire and analyze RAM from Windows, Linux, and Mac systems using Volatility, covering process, network, registry, and rootkit artifacts. Readers gain a repeatable method for finding malware that never touches disk.