A comprehensive collection of hands-on digital forensics investigations demonstrating expertise in evidence acquisition, malware analysis, incident response, and memory forensics.

Author: Faraz Ahmed
Focus: Digital Forensics | Incident Response | Malware Analysis
Tools: Autopsy, Volatility, Guymager, dc3dd, VirusTotal

This repository contains detailed documentation of four advanced digital forensics labs that demonstrate a complete investigative skillset from evidence acquisition through malware analysis. Each lab represents real-world scenarios encountered in professional forensic investigations, incident response, and security operations.

Portfolio Highlights:

• ✅ 100% success rate across all investigations
• ✅ 25+ forensic tools mastered and applied
• ✅ Multiple evidence types analyzed (disk images, memory dumps, emails, registry)
• ✅ 4 complete case studies with professional documentation
• ✅ Advanced techniques including file carving, process hollowing detection, and kernel rootkit analysis

• Forensic Imaging: Creating forensically sound evidence copies with hash verification
• File System Analysis: Deep examination of NTFS, HFS+, and APFS file systems
• Memory Forensics: Advanced memory dump analysis using Volatility Framework
• Malware Analysis: Detection and analysis of rootkits, process injection, and persistence mechanisms
• Data Recovery: File carving techniques to recover deleted evidence
• Timeline Reconstruction: Correlating evidence across multiple sources to build attack narratives

• Evidence Acquisition & Preservation: Chain of custody, hash verification, forensic imaging
• Incident Response: Phishing investigation, data breach analysis, compromise assessment
• Behavioral Analysis: User activity profiling through digital artifacts
• Attack Chain Reconstruction: Understanding attacker methodology and techniques
• IOC Extraction: Identifying and documenting indicators of compromise

• Executive Reporting: Translating technical findings for non-technical stakeholders
• Documentation: Comprehensive case documentation with reproducible methodology
• Tool Proficiency: Autopsy, Volatility, Guymager, dc3dd, VirusTotal, Linux CLI
• Regulatory Awareness: Understanding of data breach notification and compliance requirements

Focus: Evidence Acquisition & Chain of Custody
Tools: Guymager, dc3dd, md5sum
Platform: Linux

Impact: Foundational skills for all digital forensics work—proper evidence acquisition is critical for legal admissibility and investigation integrity.

Focus: File System Analysis & Deleted File Recovery
Tools: Autopsy, Guymager, File Carving
Platform: Linux, MacOS (HFS+/APFS)

Impact: Demonstrates ability to recover critical business data and conduct comprehensive system examinations—essential for corporate investigations and data recovery operations.

Focus: Incident Investigation & Behavioral Analysis
Tools: Autopsy, Email Forensics, Browser History Analysis
Platform: Windows XP

Impact: Demonstrates incident response capabilities and ability to conduct investigations that inform both technical remediation and organizational policy—critical for IR teams and SOC analysts.

Focus: Memory Analysis & Advanced Malware Detection
Tools: Volatility Framework, VirusTotal, SHA256sum
Platform: Windows XP SP2 x86

Initial Compromise (Unknown Vector)
    ↓
Kernel Rootkit Installation (mrxcls.sys, mrxnet.sys)
    ↓
Registry Persistence Configuration (Start=1)
    ↓
System Reboot
    ↓
Rootkit Auto-Loads During Boot
    ↓
Kernel Callbacks Registered
    ↓
Legitimate lsass.exe Starts
    ↓
Callback Intercepts → Process Hollowing
    ↓
Multiple Malicious lsass.exe Instances Created
    ↓
System Fully Compromised

Impact: Demonstrates advanced malware analysis capabilities essential for threat hunting, malware analysis teams, and sophisticated incident response—this is expert-level forensics.

• ✅ Disk Images: Raw (.dd), Expert Witness Format (.E01)
• ✅ Memory Dumps: Windows XP memory (.vmem)
• ✅ Email Artifacts: .eml files, headers, attachments
• ✅ File Systems: NTFS, HFS+, APFS
• ✅ Registry Hives: SYSTEM, SOFTWARE, SECURITY
• ✅ Browser History: Google Chrome, Internet Explorer
• ✅ Deleted Files: Unallocated space, $CarvedFiles
• ✅ Process Memory: Active processes, injected code
• ✅ Kernel Drivers: .sys files, rootkit components
• ✅ Network Artifacts: TCP connections, account access logs

1. Evidence Acquisition & Preservation

• Create forensic images (never work on original evidence)
• Calculate hash values for integrity verification
• Document chain of custody
• Preserve volatile data (memory) before non-volatile (disk)

2. Initial Assessment

• Identify operating system and file systems
• Configure appropriate forensic tools
• Plan investigation scope and objectives
• Establish timeline boundaries

3. Comprehensive Analysis

• Systematic examination of all evidence sources
• Multiple tool verification (don't rely on single tool)
• Document all findings with screenshots
• Extract and preserve critical artifacts

4. Correlation & Timeline Reconstruction

• Synchronize timestamps across evidence sources
• Build chronological narrative of events
• Identify relationships between artifacts
• Distinguish causation from correlation

5. IOC Extraction & Documentation

• Hash all malicious files
• Document file paths and registry keys
• Create detection signatures (YARA rules)
• Enable enterprise-wide threat hunting

6. Reporting & Recommendations

• Executive summary for stakeholders
• Technical details for peer review
• Actionable remediation steps
• Lessons learned and improvements

Total Labs Completed: 4
Success Rate: 100% (all objectives met)
Evidence Items Analyzed: 40+
Screenshots Documented: 50+
Hash Values Generated: 15+
IOCs Extracted: 10+

Lab 01 (Foundational)     ████░░░░░░  40% complexity
    ↓
Lab 02 (Intermediate)     ██████░░░░  60% complexity
    ↓
Lab 03 (Advanced)         ████████░░  80% complexity
    ↓
Lab 04 (Expert)           ██████████ 100% complexity

File Formats Analyzed:

• Image Files: PNG, JPEG, GIF, BMP, SVG, PCX
• Documents: PDF, DOCX, ODT, ODP
• Archives: TAR, XZ, ZIP
• Email: EML, MSG
• Video: MP4
• Executables: EXE, SYS, DLL
• Disk Images: DD, E01, VMEM

Platforms Investigated:

• Linux (Ubuntu-based forensic distributions)
• Windows XP SP2
• MacOS (HFS+/APFS file systems)

✅ Zero False Positives - All malware detections confirmed via multiple methods
✅ 100% Data Recovery - All requested deleted files successfully recovered
✅ Complete Attack Reconstruction - Full attack chain documented from entry to persistence
✅ Multi-Platform Expertise - Demonstrated across Linux, Windows, and MacOS
✅ Advanced Technique Mastery - Process hollowing detection, kernel rootkit analysis
✅ Professional Documentation - Executive-level reports suitable for stakeholders

Corporate Investigations:

• Data breach response (Lab 03)
• Insider threat vs. compromised user determination (Lab 03)
• Critical data recovery for executives (Lab 02)

Malware Analysis:

• Rootkit detection and analysis (Lab 04)
• Process injection identification (Lab 04)
• IOC extraction for threat hunting (Lab 04)

Incident Response:

• Timeline reconstruction (Lab 03, 04)
• Evidence preservation (Lab 01)
• Remediation recommendations (Lab 03, 04)

Digital Forensics Analyst

• Evidence acquisition and analysis ✅
• Multiple tool proficiency ✅
• Professional reporting ✅
• Chain of custody understanding ✅

Incident Response Specialist

• Breach investigation ✅
• Timeline reconstruction ✅
• Remediation recommendations ✅
• Stakeholder communication ✅

Malware Analyst

• Memory forensics ✅
• Malware detection and analysis ✅
• IOC extraction ✅
• Threat intelligence integration ✅

Security Operations Center (SOC) Analyst

• Alert investigation ✅
• Evidence correlation ✅
• Threat hunting ✅
• Tool proficiency ✅

Threat Hunter

• Advanced malware detection ✅
• Behavioral analysis ✅
• IOC development ✅
• Proactive investigation ✅

Each lab includes comprehensive documentation with:

• Executive Summary - High-level overview for stakeholders
• Detailed Methodology - Step-by-step investigative process
• Technical Analysis - In-depth examination of findings
• Screenshots & Evidence - Visual documentation of all discoveries
• Timeline Reconstruction - Chronological event correlation
• IOC Documentation - Indicators of compromise for detection
• Recommendations - Actionable remediation and improvements
• Lessons Learned - Key takeaways and best practices

Lab-XX-Name/
├── README.md (comprehensive documentation)
├── lab.pdf (Detailed and practical report with evidence)

• Chain of Custody: Documented evidence handling procedures
• Evidence Integrity: Hash verification and write-blocking
• Legal Admissibility: Court-ready documentation standards
• Anti-Forensics Detection: Identifying evidence tampering attempts

• Process Management: PIDs, PPIDs, parent-child relationships
• Memory Architecture: Kernel vs. user mode, memory permissions
• Registry Structure: Hives, keys, values, persistence mechanisms
• Security Subsystems: lsass.exe, authentication, access tokens

• Phishing: Social engineering, email spoofing, urgency tactics
• Process Hollowing: Code injection, memory manipulation
• Rootkits: Kernel-level persistence, callback hooking
• Credential Theft: lsass.exe targeting, account takeover

• NIST Framework: Preparation, Detection, Analysis, Containment, Eradication, Recovery
• Timeline Analysis: Event correlation and causation
• Triage: Rapid assessment and prioritization
• Reporting: Technical and executive communication

Acquisition & Imaging:

• Guymager (GUI-based disk imaging)
• dc3dd (forensic dd with built-in hashing)
• Write blockers (hardware/software)

Disk Forensics:

• Autopsy (comprehensive forensic platform)
• PhotoRec (file carving)
• Sleuth Kit (file system analysis)

Memory Forensics:

• Volatility Framework (memory dump analysis)
• Process analysis plugins
• Registry extraction

Hash & Verification:

• md5sum, sha256sum, sha512sum
• File integrity verification
• Evidence chain of custody

Malware Analysis:

• VirusTotal (threat intelligence)
• Static analysis tools
• IOC extraction utilities

Supporting Tools:

• Linux CLI (bash, grep, find)
• Email clients (Thunderbird)
• Archive extractors (tar, 7zip)
• Document viewers (PDF, Office)

✅ Always create forensic images before analysis
✅ Calculate and verify hash values at every step
✅ Never modify original evidence
✅ Document all actions in investigation log
✅ Maintain proper chain of custody

✅ Use multiple tools to verify findings
✅ Systematic examination (don't skip steps)
✅ Correlate evidence across multiple sources
✅ Document both positive and negative findings
✅ Distinguish between correlation and causation

✅ Reproducible methodology (others can verify)
✅ Clear documentation (technical and non-technical)
✅ Objective analysis (fact-based conclusions)
✅ Comprehensive reporting (executive summaries + details)
✅ Ethical considerations (privacy, legal requirements)

Advanced Topics Explored:

• File system forensics (NTFS, HFS+, APFS, ext4)
• Memory forensics (Windows, Linux, macOS)
• Malware reverse engineering
• Network forensics and packet analysis
• Cloud forensics (AWS, Azure, GCP)
• Mobile forensics (iOS, Android)

Industry Certifications Preparation:

• GCFA (GIAC Certified Forensic Analyst)
• GCFE (GIAC Certified Forensic Examiner)
• EnCE (EnCase Certified Examiner)
• CHFI (Computer Hacking Forensic Investigator)

Emerging Technologies:

• AI/ML for malware detection
• Container forensics (Docker, Kubernetes)
• Blockchain forensics
• IoT device forensics

GitHub: [https://github.com/TrexterX17]
LinkedIn: [https://www.linkedin.com/in/faraz-ahmed-5670931a7/]
Email: [farazx789@gmail.com]

This portfolio was developed through rigorous hands-on lab work in digital forensics education. Each investigation follows industry best practices and demonstrates real-world applicability of forensic techniques.

Tools & Resources:

• Autopsy Project (Sleuth Kit)
• Volatility Foundation
• SANS Digital Forensics & Incident Response
• NIST Computer Forensics Tool Testing Project

This portfolio is intended for:

• Educational purposes
• Professional showcase
• Job application demonstrations
• Skill verification

All investigations were conducted in controlled lab environments with proper authorization. Techniques demonstrated should only be used for legitimate forensic investigations with appropriate legal authority.