What problem does it solve?
Security professionals need to understand both how disk forensics recovers evidence (deleted files, timelines, execution artifacts) and how attackers evade it, in order to conduct incident response, red team operations, and OPSEC planning on Windows and Linux systems.
Core Features & Use Cases
- Blue Team Disk Forensics: Acquire disk images with dcfldd/ewfacquire, parse NTFS artifacts ($MFT, $UsnJrnl, Prefetch, Amcache, Shimcache, LNK, $Recycle.Bin, VSS) and Linux ext4 artifacts (inodes, journals, logs) using Sleuth Kit, Plaso, and Eric Zimmerman tools.
- Red Team Anti-Forensics: Apply secure deletion (shred, sdelete), timestomping, artifact cleanup, in-memory execution (memfd_create, /dev/shm), and history evasion to reduce disk traces during authorized engagements.
- Detection Cross-Reference: A mapping table pairs each forensic technique (file recovery, timeline analysis, USN Journal) with the corresponding red team exposure and countermeasure.
- Use Case: During a post-incident investigation, use the NTFS artifact workflow to reconstruct an attacker's execution timeline from Prefetch, Amcache, and USN Journal even after the malware binary was deleted.
Quick Start
Ask the agent to walk you through recovering deleted files and building a timeline from a Windows disk image using the NTFS artifacts reference.
