mikeroyal/digital-forensics-guideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
Note: You can easily convert this markdown file to a PDF in VSCode using this handy extension Markdown PDF.
Digital Forensics is the process of recovering and preserving material found on digital devices during the course of criminal investigations. Digital forensics tools include hardware and software tools used by law enforcement to collect and preserve digital evidence and support or refute hypotheses before courts.
Computer Forensics is the process of examining digital media in a forensic-like manner with the goal of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information.
Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics.
Network forensics is a science that centers on the discovery and retrieval of information surrounding a cybercrime within a networked environment. Common forensic activities include the capture, recording and analysis of events that occurred on a network in order to establish the source of cyberattacks.
Database forensics is the process of interrogating a failed database and trying to reconstruct the metadata and page information from within a data set, whereas database recovery implies some kind of restorative process that will enable the database to become viable enough to be put back into a production environment, or healthy enough to provide a backup that can be used in a database restore.
OSSTMM (Open Source Security Testing Methodology Manual) PDF
NIST Technical Guide to Information Security Testing and Assessment (PDF)
Applied Incident Response - Steve Anson's book on Incident Response.
Art of Memory Forensics - Detecting Malware and Threats in Windows, Linux, and Mac Memory.
Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan - by Jeff Bollinger, Brandon Enright and Matthew Valites.
Digital Forensics and Incident Response: Incident response techniques and procedures to respond to modern cyber threats - by Gerard Johansen.
Introduction to DFIR - By Scott J. Roberts.
Incident Response & Computer Forensics, Third Edition - The definitive guide to incident response.
Incident Response Techniques for Ransomware Attacks - A great guide to build an incident response strategy for ransomware attacks. By Oleg Skulkin.
Incident Response with Threat Intelligence - Great reference to build an incident response plan based also on Threat Intelligence. By Roberto Martinez.
Intelligence-Driven Incident Response - By Scott J. Roberts, Rebekah Brown.
Operator Handbook: Red Team + OSINT + Blue Team Reference - Great reference for incident responders.
Practical Memory Forensics - The definitive guide to practice memory forensics. By Svetlana Ostrovskaya and Oleg Skulkin.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response - Richard Bejtlich's book on IR.
Open Source Security Foundation (OpenSSF) npm Best Practices Guide
Open Source Security Foundation (OpenSSF) Best Practices for Open Source Developers
Open Source Security Foundation (OpenSSF) Identifying Security Threats in Open Source Projects
