performing-disk-forensics-investigation

name	performing-disk-forensics-investigation
description	Use when conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for evidence acquisition, deleted file recovery, and artifact examination. Activates for requests involving disk forensics, hard drive analysis, forensic imaging, file recovery, evidence acquisition, or digital forensic investigation. '.
domain	cybersecurity
tags	["disk-forensics","forensic-imaging","evidence-acquisition","file-recovery","chain-of-custody"]
subdomain	incident-response
mitre_attack	["T1070","T1027","T1036","T1564"]
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Performing Disk Forensics Investigation

Overview

Cybersecurity skill for performing disk forensics investigation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing disk forensics investigation"

• "Conducts disk forensics investigations using forensic imaging, file system analy"

• A security incident requires forensic analysis of a system's persistent storage

• Evidence preservation is needed for potential legal proceedings or HR investigations

• Deleted files, browser history, or application artifacts must be recovered

• A timeline of user or adversary activity must be reconstructed from file system metadata

• Malware persistence mechanisms stored on disk need identification and documentation

Do not use for volatile evidence (running processes, network connections); use memory forensics with Volatility instead.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic workstation with write-blocking hardware or software (Tableau T35u, Arsenal Image Mounter)
• Forensic imaging software: FTK Imager, Guymager, or dd with dcfldd
• Analysis platform: Autopsy, FTK (Forensic Toolkit), or X-Ways Forensics
• Sufficient storage (2-3x the target drive size for image plus working copies)
• Chain of custody forms and evidence bags for physical media
• Hash verification tools for evidence integrity (SHA-256)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}