> For the complete documentation index, see [llms.txt](https://notes.qazeer.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.qazeer.io/dfir.md).

# DFIR

- [Common](https://notes.qazeer.io/dfir/common.md)
- [Image acquisition and mounting](https://notes.qazeer.io/dfir/common/image_acquisition_and_mounting.md)
- [Memory forensics](https://notes.qazeer.io/dfir/common/memory_forensics.md)
- [Web logs analysis](https://notes.qazeer.io/dfir/common/web_logs_analysis.md)
- [Browsers forensics](https://notes.qazeer.io/dfir/common/browsers_forensics.md)
- [Email forensics](https://notes.qazeer.io/dfir/common/email_forensics.md)
- [Docker forensics](https://notes.qazeer.io/dfir/common/docker_forensics.md)
- [Windows](https://notes.qazeer.io/dfir/windows.md)
- [Artefacts overview](https://notes.qazeer.io/dfir/windows/_artefacts_overview.md)
- [Amcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/amcache.md)
- [EVTX](https://notes.qazeer.io/dfir/windows/_artefacts_overview/evtx.md)
- [Jumplist](https://notes.qazeer.io/dfir/windows/_artefacts_overview/jumplist.md)
- [LNKFile](https://notes.qazeer.io/dfir/windows/_artefacts_overview/lnkfile.md)
- [MFT](https://notes.qazeer.io/dfir/windows/_artefacts_overview/mft.md)
- [Outlook\_files](https://notes.qazeer.io/dfir/windows/_artefacts_overview/outlook_files.md)
- [Prefetch](https://notes.qazeer.io/dfir/windows/_artefacts_overview/prefetch.md)
- [RecentFilecache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recentfilecache.md)
- [RecycleBin](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recyclebin.md)
- [Shellbags](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shellbags.md)
- [Shimcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shimcache.md)
- [SRUM](https://notes.qazeer.io/dfir/windows/_artefacts_overview/srum.md)
- [Timestamps](https://notes.qazeer.io/dfir/windows/_artefacts_overview/timestamps.md)
- [User Access Logging (UAL)](https://notes.qazeer.io/dfir/windows/_artefacts_overview/user_access_logging.md)
- [UsnJrnl](https://notes.qazeer.io/dfir/windows/_artefacts_overview/usnjrnl.md)
- [Miscellaneous](https://notes.qazeer.io/dfir/windows/_artefacts_overview/misc.md)
- [TTPs analysis](https://notes.qazeer.io/dfir/windows/ttps_analysis.md)
- [Accounts usage](https://notes.qazeer.io/dfir/windows/ttps_analysis/accounts_usage.md)
- [Local persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/local_persistence.md)
- [Lateral movement](https://notes.qazeer.io/dfir/windows/ttps_analysis/lateral_movement.md)
- [PowerShell activity](https://notes.qazeer.io/dfir/windows/ttps_analysis/powershell_activity.md)
- [Program execution](https://notes.qazeer.io/dfir/windows/ttps_analysis/program_execution.md)
- [Timestomping](https://notes.qazeer.io/dfir/windows/ttps_analysis/timestomping.md)
- [EVTX integrity](https://notes.qazeer.io/dfir/windows/ttps_analysis/evtx_integrity.md)
- [System uptime](https://notes.qazeer.io/dfir/windows/ttps_analysis/system_uptime.md)
- [ActiveDirectory replication metadata](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_replication_metadata.md)
- [ActiveDirectory persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_persistence.md)
- [Linux](https://notes.qazeer.io/dfir/linux.md)
- [Artefacts overview](https://notes.qazeer.io/dfir/linux/_artefacts_overview.md)
- [TTPs analysis](https://notes.qazeer.io/dfir/linux/ttps_analysis.md)
- [Timestomping](https://notes.qazeer.io/dfir/linux/ttps_analysis/timestomping.md)
- [Cloud](https://notes.qazeer.io/dfir/cloud.md)
- [Azure](https://notes.qazeer.io/dfir/cloud/azure.md)
- [AWS](https://notes.qazeer.io/dfir/cloud/aws.md)
- [Tools](https://notes.qazeer.io/dfir/tools.md)
- [Velociraptor](https://notes.qazeer.io/dfir/tools/velociraptor.md)
- [KAPE](https://notes.qazeer.io/dfir/tools/kape.md)
- [Dissect](https://notes.qazeer.io/dfir/tools/dissect.md)
- [plaso](https://notes.qazeer.io/dfir/tools/plaso.md)
- [Splunk usage](https://notes.qazeer.io/dfir/tools/splunk.md)