Performing Endpoint Forensics Investigation

When to Use

Use this skill when:

• Investigating a confirmed or suspected endpoint compromise requiring forensic analysis
• Collecting volatile and non-volatile evidence for incident response or legal proceedings
• Analyzing memory dumps for malware, injected code, or credential theft artifacts
• Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache)

Do not use this skill for live threat hunting (use EDR/SIEM) or network forensics.

Prerequisites

• Forensic workstation with analysis tools (Volatility 3, KAPE, Autopsy, Eric Zimmerman tools)
• Write-blocker for disk imaging (hardware or software)
• Secure evidence storage with chain-of-custody documentation
• Memory acquisition tool (WinPMEM, FTK Imager, Magnet RAM Capture)
• Administrative access to the target endpoint (or physical access)

Workflow

Step 1: Evidence Preservation (Order of Volatility)

Collect evidence from most volatile to least volatile:

1. System memory (RAM) - Most volatile
2. Network connections and routing tables
3. Running processes and open files
4. Disk contents (file system)
5. Removable media
6. Logs a…