forensic-analyst

Reconstruct an attack timeline by collecting and examining memory, registry, logs, and network artifacts using LimaCharlie LCQL queries. This forensic workflow correlates evidence across Windows and Linux endpoints to trace attacker activity from initial compromise to final actions.

Preserve digital evidence and maintain chain-of-custody by following a structured 6-phase forensic workflow: preservation, collection, examination, analysis, recording, and reporting. This methodology enforces data integrity and generates auditable reports for defensible incident response investigations.

Yes, memory analysis and artifact collection are fully supported across both Windows and Linux endpoints. The forensic workflow applies dedicated memory analysis tooling and LCQL queries to extract and examine volatile artifacts regardless of the endpoint operating system.

Generate auditable forensic reports by systematically recording findings from artifact examination and timeline analysis. The workflow transforms raw LCQL query results and collected evidence into structured, evidence-backed narratives that ensure traceability and support post-incident investigations.

Yes, LimaCharlie supports post-incident forensics through comprehensive registry and network analysis. The forensic workflow guides analysts through targeted artifact review, applying LCQL queries to extract registry keys and network artifacts to reconstruct attacker movement and generate defensible reports.