Machine translation

This page was translated by machine and has not been checked by a person yet. Deutsch

Other language versions: Deutsch

DFIR Notes

A collection of information on digital forensics and incident response (DFIR).

Always work in progress – there is always something new to discover.

Contents

DFIR Artifacts

Descriptions of artifacts of all kinds. Overview of their meaning, sources, key facts and tools/scripts for processing.

Deep Dives

Analyses and details on, for example, file systems, file formats and timestamps. Everything that is not specifically an artifact or would be too much for a single artifact description.

Glossary

Glossary with descriptions of terms in digital forensics, for example as text blocks for use in reports.

Content status

Pages marked Not reviewed are drafts that have not been reviewed yet. They are marked with an icon in the navigation. Sections without content are marked “Noch kein Inhalt.” (no content yet).

Languages

Pages can be written in any of the site's languages, currently German and English; most of them exist in German only so far. All language versions of a page are equal; further versions and languages are added gradually. If a page does not exist in a language, another version is shown – English first, otherwise German – and marked accordingly.

License

The content is licensed under CC BY 4.0. It may be freely used, shared and adapted, including commercially, provided the source is credited.

Linked third-party documents are subject to the terms of their respective authors.

Corrections and feedback

Found an error or have an addition? Feel free to open an issue on GitHub.