, TABLE OF CONTENTS - TQN1 TASK 1 SECTIONS A-G
SECTION FOCUS TOOLS & EVIDENCE
A: Case Overview & Chain
Incident
of Custody
summary, evidence handling Chain of custody form CASE #TQN1-001
B: Forensic Imaging &Disk
Hashimaging
Verification
dd, FTK Imager, SHA256 Hash verification, write-blocker
C: Autopsy Setup & File
Autopsy
System
4.19,
Analysis
ingest modules File system, $MFT, deleted files
D: Timeline Reconstruction
MAC times, registry, log analysis Timeline, event correlation
E: Keyword Search & Keyword
Artifact Analysis
search, web history, email Artifacts, LNK, prefetch
F: Evidence Analysis &
User
Findings
activity, exfiltration evidence Report findings
G: Reporting & Recommendations
Final report, remediation Recommendations, lessons learned
SECTION FOCUS TOOLS & EVIDENCE
A: Case Overview & Chain
Incident
of Custody
summary, evidence handling Chain of custody form CASE #TQN1-001
B: Forensic Imaging &Disk
Hashimaging
Verification
dd, FTK Imager, SHA256 Hash verification, write-blocker
C: Autopsy Setup & File
Autopsy
System
4.19,
Analysis
ingest modules File system, $MFT, deleted files
D: Timeline Reconstruction
MAC times, registry, log analysis Timeline, event correlation
E: Keyword Search & Keyword
Artifact Analysis
search, web history, email Artifacts, LNK, prefetch
F: Evidence Analysis &
User
Findings
activity, exfiltration evidence Report findings
G: Reporting & Recommendations
Final report, remediation Recommendations, lessons learned
