DFIR Guidebook
A working reference for digital forensics and incident response, built to keep open during live investigations: what each artifact proves, where each log source has gaps, playbooks for common incident types, how threat actors operate, and the legal and engagement mechanics around the technical work. Covers Windows, Linux and macOS hosts, AWS, Microsoft 365 / Entra, Okta, the major SaaS platforms and EDR consoles.
Start here - by situation #
Find the row that matches what you're facing, do the first moves, then work from the linked sections.
| Situation | First moves | Go to |
|---|---|---|
| Ransomware - encryption active or just discovered | Isolate affected segments through the EDR; take backups and hypervisor management offline from the attacker's reach; revoke tier-0 credentials; preserve one encrypted host and the encryptor binary | Ransomware playbook · Operator behavior · EDR live response · OFAC & payment |
| Business email compromise or mailbox takeover | If a wire went out, contact the bank and FBI IC3 now; place a Purview hold; revoke the user's sessions; pull UAL and Entra sign-ins for the window | BEC playbook · M365 / Entra · M365 first moves |
| Leaked cloud keys or AWS console anomaly | Deactivate the key (don't delete it); confirm CloudTrail is still logging; snapshot IAM with get-account-authorization-details | AWS keys playbook · AWS IR · AWS first moves |
| Identity provider / SSO compromise, MFA bypass | Revoke sessions and tokens; review factor and device changes, admin role grants and API tokens; list every downstream app reachable through SSO | Okta · Entra ID · Identity-only intrusion card |
| Edge device (VPN, firewall, gateway) advisory or exploitation | Collect appliance logs, config and memory before patching or rebooting; run the vendor's integrity checker; rotate every credential the device stores | Edge-device card · Intrusion lifecycle |
| SaaS data theft or an extortion claim | Validate any sample the actor sent; preserve SaaS logs before retention rolls; identify the access path (credentials, OAuth app, file-transfer zero-day) | Data-theft card · Salesforce · Snowflake · Google · GitHub |
| Compromised Linux server | Capture memory first (AVML), then run UAC; check persistence, ld.so.preload and loaded eBPF programs | Linux · Memory · Linux first moves |
| Compromised macOS endpoint | sudo sysdiagnose, log collect, sfltool dumpbtm | macOS · macOS first moves |
| Windows host - suspicious execution or lateral movement | Contain through the EDR; collect a KAPE or Velociraptor triage package; pull Security, System and PowerShell logs before they roll | Windows · EDR live response |
| Suspected insider or fake employee | Engage HR and counsel before acting; preserve quietly so the subject isn't tipped off | Insider card · Legal & privilege |
| Evidence must hold up in litigation or regulatory review | Legal hold; hashed exports; start the custody log now | M365 preservation · Chain of custody |
Reading this guidebook
- ts: notes explain what a timestamp actually records, its epoch and resolution, and how long the source keeps data.
- Green tool callouts list the parsers and collectors for that artifact. Red callouts are pitfalls: conclusions that often end up in reports and are wrong.
- Hover any dotted-underlined acronym for its expansion.
- Working rule: for every artifact you cite, state what it proves, what it rules out, and what its coverage gap is.