Incident response and digital forensics. From the first sign of a threat to analysing digital evidence and understanding what happened.
Establishing what happened, how far an incident extends and which systems are affected. Containing the impact, preserving evidence and supporting a safe return to operation.
Examining data from devices, memory and logs. Connecting artefacts into a timeline while accounting for data integrity, context and the limits of the available evidence.
Explore DFIRoscope, a project focused on analysing digital evidence. Find EDU releases, video walkthroughs and downloads on the project website.
Explore DFIRoscopeI’m Tomasz Lapaj. Connect with me to exchange ideas and discuss incident response, digital forensics and related projects.