forensics-pentest

name	forensics-pentest
description	Guides digital forensics methodology for disk images, memory dumps, pcaps, and artifact analysis. Use when analyzing evidence to support incident response, malware triage, or pentest finding validation.

Forensics Pentest

Prerequisites

• Evidence (image, dump, pcap) is authorized and chain-of-custody documented.
• Work on copies; never modify original evidence media.
• Forensic analysis during active pentest supports finding validation and IOC extraction.

Workflow

Task Progress:
- [ ] Acquire or mount forensic image (write-blocker if hardware)
- [ ] Identify partitions, filesystem, and timeline
- [ ] Run targeted artifact extraction (registry, browser, logs)
- [ ] Analyze memory dump or pcap if available
- [ ] Document IOCs and link to reporting-pentest findings

Phase 1: Image acquisition and mounting

Disk imaging

MSF: No direct module. Use dd/dcfldd for acquisition.

CLI fallback:

dd if=/dev/sdb of=evidence.img bs=4M status=progress
dcfldd if=/dev/sdb of=evidence.img hash=sha256 hashlog=hashes.txt
sha256sum evidence.img

Mount safely (read-only)

MSF: No direct module. Use loop mount and Sleuth Kit.

CLI fallback:

sudo mount -o ro,loop evidence.img /mnt/evidence
sudo losetup -Pr /dev/loop0 evidence.img
mmls evidence.img
fls -r -o 2048 evidence.img
file evidence.img
fdisk -l evidence.img
fsstat -o 2048 evidence.img

Phase 2: File and data carving

binwalk

MSF: No direct module. Use binwalk CLI.

CLI fallback:

binwalk evidence.img
binwalk -e evidence.img
binwalk -A evidence.img
foremost -i evidence.img -o carved/
scalpel -c scalpel.conf evidence.img
exiftool -r /mnt/evidence/

Phase 3: Memory forensics

Volatility 3

MSF: No direct module. Use Volatility CLI.

CLI fallback:

vol -f memory.dmp windows.info
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.pstree
vol -f memory.dmp windows.netscan
vol -f memory.dmp windows.cmdline
vol -f memory.dmp windows.malfind
vol -f memory.dmp windows.hashdump
vol -f memory.lime linux.pslist
vol -f memory.lime linux.bash

Key memory artifacts

Plugin	Purpose
pslist/pstree	Running processes
netscan/sockscan	Network connections
cmdline	Process command lines
malfind	Injected code detection
hashdump	NTLM hashes (Windows)
filescan	Open file handles
dlllist	Loaded DLLs

Phase 4: Host artifact analysis

Windows registry (offline)

MSF: No direct module. Use regripper.

CLI fallback:

regripper -r SYSTEM -p compname
regripper -r SOFTWARE -p run
regripper -r NTUSER.DAT -p userassist

Linux and browser artifacts

MSF: No direct module. Use filesystem grep and sqlite3.

CLI fallback:

grep -r "Accepted" /mnt/evidence/var/log/auth.log
cat /mnt/evidence/home/*/.bash_history
find /mnt/evidence -name "id_rsa" -o -name "*.conf"
sqlite3 History "SELECT url, visit_count FROM urls ORDER BY visit_count DESC LIMIT 20;"

Timeline analysis

MSF: No direct module. Use plaso.

CLI fallback:

log2timeline.py --storage-file timeline.plaso evidence.img
psort.py -o l2tcsv -w timeline.csv timeline.plaso

Phase 5: PCAP and network forensics

Wireshark/tshark

MSF: No direct module. Use tshark CLI.

CLI fallback:

tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name
tshark -r capture.pcap -z conv,ip
tshark -r capture.pcap --export-objects http,exported/
suricata -r capture.pcap -l suricata_logs/

Phase 6: Malware triage

MSF: No direct module. Use hash and strings analysis.

CLI fallback:

sha256sum suspicious.exe
strings suspicious.exe | grep -E "http|password|cmd"
diec suspicious.exe

Impact escalation

Stage	Technique
Triage	Hashes, strings, file type
Timeline	Establish attack sequence
IOCs	IPs, domains, file paths, registry keys
Credentials	hashdump, browser creds, config files
Validation	Confirm pentest finding impact with artifacts

Metasploit integration

Correlate forensic IOCs with MSF workspace data.

Import scan artifacts

MSF MCP (preferred):

msf_db_import(
  engagement_id="<id>",
  file_path="evidence/msf/nmap-scan.xml"
)
msf_db_import(
  engagement_id="<id>",
  file_path="evidence/msf/burp-export.xml"
)

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'db_import evidence/msf/nmap-scan.xml; db_import evidence/msf/burp-export.xml; exit'"

Query workspace data

MSF MCP (preferred):

msf_host_info()
msf_service_info()
msf_credential_info()
msf_loot_info()
msf_note_info()

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'hosts; services; creds; loot; notes; exit'"

Add forensic notes to MSF database

MSF MCP (preferred):

msf_console_execute(
  engagement_id="<id>",
  command="notes -a <target> -t forensics -n \"IOC: suspicious.exe sha256=<hash>\""
)

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'notes -a <target> -t forensics -n \"IOC: suspicious.exe sha256=<hash>\"; exit'"

Use msf_db_import to merge external scan artifacts into the engagement workspace.

Related skills

• methodology-cheatsheets - cross-cutting forensic references
• reversing-pentest - deep binary analysis after triage
• reporting-pentest - document forensic findings for client