Digital Forensics and Incident Response

(DFIR)
Lecture Notes

Table of Contents
1. DFIR: An Introduction
2. Investigating Windows
3. Windows Forensics: Registry and File Systems
4. Redline: Memory Analysis and IOC Scanning
5. Disk Analysis & Autopsy
6. Homework Activity (Exercises)

1. DFIR: An Introduction
1.1 What is DFIR?
Digital Forensics and Incident Response (DFIR) is a cybersecurity discipline
that combines two key activities [^1][^7]:
 Digital Forensics (DF): The systematic collection, preservation, and
analysis of digital evidence to determine what happened during a
security incident. This evidence must meet standards sufficient for
potential legal proceedings [^7].
 Incident Response (IR): The coordinated set of procedures deployed
to identify, contain, eradicate, and recover from security incidents,
minimizing disruption to business operations [^7].
Think of it this way: if someone breaks into your house, incident response
is about securing the house, stopping the burglar, and fixing the damage.
Digital forensics is like the detective work — dusting for fingerprints,
checking security cameras, and building a case for court.

1.2 Why is DFIR Important?

When a cyber attack occurs, the first priority is recovering from the incident.
But recovery alone is not enough. Organizations need to understand what
happened, who was behind the attack, how they broke in, and the exact
steps they took [^1]. DFIR provides this deep understanding through a
comprehensive forensic process. The information collected is frequently used
to file lawsuits, assist law enforcement, and serve as evidence in court
proceedings [^1].
In Africa, cybercrime now accounts for more than 30% of all reported crime
in Western and Eastern Africa [^26]. This makes DFIR skills critically
important for the continent’s cybersecurity workforce.

1.3 The DFIR Process (Incident Response Lifecycle)

The incident response lifecycle follows six distinct phases [^10]:
1. Preparation: Proactive implementation of defensive measures,
including risk assessment, vulnerability management, and
development of incident response plans.
2. Detection and Analysis: Continuous monitoring for anomalous
activity, with analysis to differentiate between false positives and real
security events.
3. Containment: Isolating the threat to prevent further damage (e.g.,
disconnecting a compromised server from the network).
4. Eradication: Removing the threat entirely from the environment (e.g.,
removing malware, closing exploited vulnerabilities).
5. Recovery: Restoring affected systems to normal operation while
monitoring for signs of recurring threats.
6. Post-Incident Review (Lessons Learned): Analyzing the incident to
identify security gaps, evaluate response effectiveness, and implement
improvements [^10].
1.4 Key Concepts
 Chain of Custody: Tracking every movement of digital evidence to
prove no one has tampered with it. This is essential for evidence to be
admissible in court [^10].
 Evidence Integrity: Ensuring that original data is never modified
during the investigation. Investigators always work on copies.
 Forensic Image: An exact bit-for-bit copy of a storage device used for
investigation, so the original remains untouched.
 Indicators of Compromise (IOCs): Pieces of evidence (e.g., IP
addresses, file hashes, domain names) that indicate a system has been
breached.
1.5 Real-Life Example: Somalia E-Visa Data Breach (2025)
In November 2025, Somalia’s Immigration and Citizenship Agency confirmed
that hackers breached its electronic visa platform, exposing sensitive
personal data of at least 35,000 individuals, including thousands of American
and British citizens [^31][^34]. The leaked data included visa applicants’
names, photos, dates of birth, email addresses, marital status, and home
addresses [^37].
Why DFIR matters here: The Somali immigration agency launched an
investigation to determine “the extent of the attempted breach, its origin,
and any potential impact” [^34]. This is exactly the DFIR process in action —
detecting the breach, analyzing how it occurred, containing the damage
(moving the system to a new website), and working to prevent recurrence.
Without DFIR skills and processes, the government would be unable to
understand how the attack happened or protect citizens going forward.

1.6 Real-Life Example: Malawi Passport System Ransomware

Attack (2024)
In February 2024, Malawi’s government suspended passport issuance
following a ransomware cyber-attack on the immigration service’s computer
network [^33]. President Lazarus Chakwera called it a “serious national
security breach” and revealed the hackers were demanding a ransom of over
$1 million [^45]. The president declared: “We are not in the business of
appeasing criminals with public money” [^33].
DFIR Lesson: The Malawi government needed digital forensics to
investigate the breach’s origin, determine if personal data was compromised,
and restore the system. A team of local experts worked to recover the
system, and it was restored after several weeks [^36]. This case shows how
a country without adequate incident response preparation can face weeks of
disrupted government services.

1.7 Real-Life Example: Kenya Cyber Threats and DCI Forensics

Lab
Kenya ranks among the most cyber-attacked countries in Africa, facing 3,030
ransomware detections in 2024 alone, including a breach at Kenya’s Urban
Roads Authority (KURA) [^26]. In response, Kenya’s Directorate of Criminal
Investigations (DCI) received state-of-the-art digital forensic equipment from
the German government in 2025, and the DCI’s Cyber and Digital Forensics
Laboratory has been designated as a regional center of excellence for
Eastern Africa [^32].
DFIR Lesson: Kenya’s investment in digital forensics infrastructure
demonstrates how nations are building DFIR capabilities to combat rising
cybercrime. The DCI lab conducts forensic analysis of digital media
containing evidence relevant to ongoing investigations [^44].

2. Investigating Windows
2.1 Why Investigate Windows Systems?
Windows is the most widely used operating system in the world, making it
the most common target for cyber attacks. When a Windows system is
compromised, investigators must carefully examine the system to
understand:
 What happened (timeline of events)
 How the attacker gained access
 What data was accessed, modified, or stolen
 What malware or tools the attacker used
 Whether the attacker established persistence (a way to come back)
2.2 Key Areas to Investigate on a Compromised Windows System
Investigation Area What to Look For Common Tools
Running Processes Suspicious or unknown Task Manager, Process
processes consuming Explorer
resources
Network Connections Unusual outbound Netstat, TCPView,
connections to Wireshark
unknown IP addresses
User Accounts Newly created Event Viewer, net user
accounts, privilege command
escalations
Scheduled Tasks Tasks created by Task Scheduler,
attackers for schtasks
persistence
Startup Programs Programs that auto- Autoruns (Sysinternals)
start to maintain
attacker access
Event Logs Login attempts, system Event Viewer,
changes, errors EvtxECmd
File System Recently Explorer, dir command,
modified/created files, FTK
suspicious executables
Registry New registry keys for RegEdit, RegRipper
persistence or
configuration changes

2.3 Windows Event Logs

Windows Event Logs are one of the most valuable forensic artifacts. They
record virtually everything happening on a system. The main log categories
are:
 System Log: Records events from the Windows operating system
(driver failures, hardware events, service start/stop).
  Application Log: Records events from applications running on the
system.
 Security Log: Records security-related events such as login attempts
(successful and failed), account creation, and permission changes. This
is the most forensically valuable log.
Key Event IDs to Know:

Event
ID Description
4624 Successful login
4625 Failed login attempt
4648 Login using explicit credentials
4720 A user account was created
4732 A member was added to a
security group
7045 A new service was installed

2.4 Practical Investigation Workflow

1. Isolate the system — Disconnect from the network to prevent further
compromise, but do NOT power off (volatile data may be lost).
2. Capture volatile data — Collect RAM, running processes, network
connections.
3. Create a forensic image — Make a bit-for-bit copy of the disk.
4. Analyze event logs — Look for suspicious logins, new accounts,
service installations.
5. Check running processes — Identify unknown or suspicious
processes.
6. Examine network connections — Check for connections to known
malicious IPs.
7. Review scheduled tasks and startup entries — Look for
persistence mechanisms.
8. Document and report findings — Maintain chain of custody
throughout.
2.5 Real-Life Context: Kenya’s Urban Roads Authority (KURA)
Breach
Kenya’s Urban Roads Authority (KURA) suffered a cyber breach in 2024, one
of many attacks on critical infrastructure in the country [^26]. Investigating
such a breach on Windows-based government systems would involve
examining event logs for unauthorized access, checking for malware
installation via scheduled tasks, and tracing network connections to identify
the attacker’s command-and-control servers. Kenya’s DCI forensic lab now
has the tools to conduct such investigations [^32].

3. Windows Forensics: Registry and File Systems

3.1 The Windows Registry
The Windows Registry is a central hierarchical database that stores system
configurations, software settings, user preferences, and activity records
[^22]. It is one of the richest sources of forensic evidence available to
investigators [^18].
Think of the Registry as the “diary” of a Windows computer — it
records what programs were installed, what USB devices were connected,
what files were opened, and much more.

3.2 Registry Structure

The registry is organized into hives, each containing different types of
information [^18][^22]:

Hive Location What It Contains

SAM C:\Windows\System32\ User accounts,
config\SAM passwords (hashed),
login information
SYSTEM C:\Windows\System32\ Hardware
config\SYSTEM configuration, services,
device drivers
SOFTWARE C:\Windows\System32\ Installed software, OS
config\SOFTWARE settings
SECURITY C:\Windows\System32\ Security policies,
config\SECURITY access control
[Link] C:\Users\<username>\ User-specific settings,
[Link] recent activity [^19]
AmCache C:\Windows\AppCompat\ Recently executed
Programs\[Link] programs [^27]

3.3 Key Registry Forensic Artifacts

Forensic analysts can extract the following valuable evidence from the
registry [^18][^19]:
 Recent Documents (RecentDocs): Files recently opened by the
user.
 Typed URLs: Web addresses typed into Internet Explorer/Edge.
  UserAssist: Programs executed by the user with execution count and
timestamp.
 USB Device History (USBSTOR): Records of every USB device ever
connected to the system (found in SYSTEM hive under HKLM\SYSTEM\
CurrentControlSet\Enum\USBSTOR).
 Run/RunOnce Keys: Programs configured to run at startup — a
common place for malware persistence.
 ShellBags: Records of folder access and window positions, showing
which folders a user browsed.
 WordWheelQuery: Search terms typed in Windows Search/Explorer.
3.4 Registry Analysis Tools
 RegRipper: Parses registry hives and extracts forensically valuable
data using plugins [^30].
 Registry Explorer: GUI-based tool for browsing and analyzing registry
hives [^19].
 RECmd: Command-line registry parser [^19].
 FTK Registry Viewer: Part of the Forensic Toolkit for viewing registry
data [^18].
3.5 NTFS File System Forensics
The New Technology File System (NTFS) is the default file system for
Windows operating systems [^16]. Understanding NTFS is essential for
forensic analysis because it contains structures that record file activity.
Key NTFS Forensic Components:
 Master File Table (MFT): A database that stores a record for every
file and directory on an NTFS volume, including file name, size,
timestamps (created, modified, accessed), and location on disk [^16]
[^19]. The MFT is like the “index” of a library catalog — it tells you
where everything is.
 $LogFile: Keeps a transaction log of all operations on the NTFS
volume (file creation, deletion, renaming, copying). This is invaluable
for timeline analysis [^19].
 $UsnJrnl (USN Journal): The Update Sequence Number Journal
records changes to files and directories. Even if a file is deleted, the
journal may still contain a record of it.
 Alternate Data Streams (ADS): NTFS allows files to have multiple
data streams. Attackers sometimes hide malware in alternate data
streams because they are not visible through normal file browsing.
3.6 Real-Life Context: Somalia Cyberattacks on Journalists (2024)
In late 2024, a wave of coordinated cyberattacks targeted Somali journalists,
bloggers, public figures, and government officials, disrupting over 32
Facebook accounts [^40]. The attackers used forged death certificates to
deceive Facebook’s systems into removing or memorializing accounts of
living journalists [^40].
Forensic Relevance: If investigators were to examine the attackers’
Windows systems, they would look at: - Registry artifacts (RecentDocs,
Typed URLs) to find evidence of forged document creation. - NTFS MFT
records to identify when fake death certificates were created and modified.
- USB device history in the registry to check if files were transferred to
external media.

3.7 Real-Life Context: Malawi Ransomware Investigation

During the Malawi passport system ransomware attack, the hackers took
over the country’s critical passport printing system [^36]. When local
experts worked to restore the system, they would have needed to: - Examine
the Windows Registry Run keys to find if the ransomware had set up
persistence mechanisms. - Analyze the NTFS file system to identify
encrypted files, ransomware executables, and ransom notes. - Review the
$LogFile and MFT to create a timeline of when the attack began and what
files were modified.

4. Redline: Memory Analysis and IOC Scanning

4.1 What is Redline?
Redline is a free tool developed by Mandiant (formerly FireEye) designed for
triaging hosts suspected of being compromised or infected [^11]. It provides
analysts with a “30,000-foot view” of a Windows, Linux, or macOS endpoint
[^5]. While tools like Volatility allow deep-dive memory analysis, Redline is
designed for rapid triage when time is critical [^5].
Simple Analogy: If Volatility is like performing surgery to find a problem,
Redline is like doing an X-ray — it gives you a quick, broad view to identify
what needs further investigation.

4.2 What Can Redline Do?

Using Redline, an analyst can [^5][^2]:
 Collect and analyze running processes — identify suspicious or
malicious processes
 Collect registry data (Windows hosts only)
  Collect memory images (before Windows 10)
 Analyze browser history — check for malicious downloads or
phishing sites visited
 Look for suspicious strings in memory
 Scan for Indicators of Compromise (IOCs)
 Review event logs, scheduled tasks, and services
 Use Timeline Analysis to determine when an attack started and what
actions were taken [^5]
4.3 Understanding Indicators of Compromise (IOCs)
IOCs are pieces of forensic data that identify potentially malicious activity on
a system or network. They are like “digital fingerprints” of an attack.
Types of IOCs:

IOC Type Example

File Hash (MD5/SHA256) d41d8cd98f00b204e9800998ecf8427e
IP Address [Link] (attacker’s server)
Domain Name [Link]
File Name evil_payload.exe
Registry Key HKLM\Software\Microsoft\Windows\
CurrentVersion\Run\malware
Mutex Name Used by malware to ensure only one
instance runs

4.4 How Redline Works: Step-by-Step

1. Create a Collector: Redline creates a collection script that is run on
the target (suspected compromised) machine. There are three types of
collectors:
o Standard Collector: Collects minimum data for analysis.
o Comprehensive Collector: Collects more extensive data.
o IOC Search Collector: Specifically searches for known IOCs.
2. Run the Collector on the Target Machine: The script is copied to a
USB drive and run on the suspect machine. It gathers data including
processes, memory, registry, event logs, and file system metadata.

3. Analyze the Results in Redline: The collected data is opened in

Redline’s graphical interface [^2].

4. Review Key Areas:

o Processes: Check for suspicious processes, unknown

executables, or processes running from unusual locations.
 o Malware Risk Index (MRI): Redline assigns an MRI score (0–
100) to artifacts based on heuristics, where 100 is the riskiest
[^11].
o Timeline: Examine the chronological sequence of events to
reconstruct the attack.
o IOC Hits: If IOC files were loaded, review any matches found.
5. Report Findings: Export the analysis for documentation and further
investigation.

4.5 Creating IOCs with IOC Editor

Mandiant provides a companion tool called IOC Editor that allows analysts
to create custom IOC files in the OpenIOC format. These IOC files can then be
imported into Redline for targeted scanning [^8].
Example: After learning that a specific malware uses the file name
[Link] (note: legitimate svchost is [Link]), an analyst can
create an IOC to search all endpoints for this indicator.

4.6 Real-Life Context: Detecting Ransomware in Malawi’s Systems

When Malawi’s passport system was hit by ransomware [^33], investigators
could have used Redline to: - Capture running processes on affected
machines to identify the ransomware executable. - Scan for known
ransomware IOCs (file hashes, registry keys, mutex names) to determine
which ransomware family was used. - Analyze the timeline to determine
exactly when the ransomware was deployed and how it spread. - Check
scheduled tasks for any persistence mechanisms left by the attackers.
Common ransomware families detected in Africa include WannaCry,
Stop/Djvu, PolyRansom/VirLock, and LockBit [^23].

4.7 Real-Life Context: Investigating Kenya’s Endpoint

Compromises
Kenya faces thousands of ransomware detections annually [^26]. When the
DCI’s digital forensic lab investigates a compromised endpoint in a Kenyan
government agency [^44], Redline can be used as a first-response triage
tool to quickly assess: - Whether the endpoint is actively communicating with
a command-and-control server. - What processes are running that should not
be running. - Whether any known IOCs from threat intelligence feeds match
artifacts on the machine.
5. Disk Analysis & Autopsy
5.1 What is Disk Forensics?
Disk forensics is the process of extracting forensic information from storage
mediums like hard drives, USB devices, and firmware [^6]. It plays a crucial
role in DFIR investigations by uncovering artifacts left behind by attackers or
criminal activity. When investigators seize a computer or hard drive, disk
forensics allows them to recover deleted files, trace user activity, and build a
timeline of events [^6].

5.2 What is Autopsy?

Autopsy is a free, open-source digital forensics platform built on The Sleuth
Kit (TSK) [^3][^12]. It provides a user-friendly graphical interface for
analyzing hard drives and smartphones. Autopsy is used by law
enforcement, military, and corporate examiners worldwide to investigate
what happened on a computer [^12].
Key Capabilities of Autopsy [^3]:
 Analyze disk images (E01, raw/dd, VHD, VMDK formats)
 Recover deleted files
 Analyze web browsing history
 Detect file type mismatches (a file named .jpg that is actually .exe)
 Perform keyword searches across the entire disk
 Timeline analysis of all file system activity
 Hash lookup (compare files against known malware hash databases)
 Email parsing and analysis
 Extract EXIF data from images (location, camera, timestamp)
5.3 Disk Imaging: The First Step
Before any analysis, the investigator must create a forensic disk image —
an exact bit-for-bit copy of the original storage device. This ensures the
original evidence remains unaltered [^9].
Common Imaging Tools: - FTK Imager: Free tool for creating forensic
images. - dd (Linux command): dd if=/dev/sda of=suspect_image.dd
bs=4096 - Guymager: Open-source Linux-based imaging tool.

Important: Always use a hardware write blocker when connecting a

suspect disk to your forensic workstation. This prevents any accidental writes
to the evidence disk [^9].
5.4 Working with Autopsy: Step-by-Step
Step 1: Create a New Case - Open Autopsy and select “New Case.” - Enter
the case name, number, and examiner information. - Choose a location to
save the case files [^9].
Step 2: Add a Data Source - Select the type of data source: Disk Image
(E01, raw), Local Disk, or Logical Files. - Browse to your forensic image file. -
Select which ingest modules to run [^3].
Step 3: Configure Ingest Modules Ingest modules are automated analysis
plugins. Key modules include [^9]: - Recent Activity: Extracts web
browsing history, downloads, cookies, and recent documents. - Hash
Lookup: Compares file hashes against known good (NSRL) and known bad
(malware) hash sets. - Keyword Search: Searches for specific terms across
the disk (names, email addresses, etc.). - File Type Identification:
Identifies files by their actual content, not just extension. - Extension
Mismatch Detector: Flags files whose extension does not match their
actual type. - Email Parser: Extracts emails from PST, MBOX files. -
Encryption Detection: Identifies encrypted files or volumes. - YARA
Analyzer: Scans files using YARA rules for malware patterns.
Step 4: Analyze Results - Browse the file tree to explore the disk’s
directory structure. - Use the Views panel to filter by file type, size, or date. -
Check Data Artifacts for extracted web history, downloads, installed
programs. - Use the Timeline feature to visualize file system activity over
time [^3].
Step 5: Generate a Report - Tag relevant evidence items throughout the
investigation. - Generate a report in HTML, Excel, or text format for
documentation.

5.5 Deleted File Recovery

When a file is “deleted” on a computer, the data is not immediately erased.
The file system simply marks the space as available for reuse. Until new data
overwrites that space, the original file can be recovered. Autopsy excels at
recovering deleted files from NTFS, FAT, and ext file systems [^3].

5.6 Real-Life Context: Somalia E-Visa Breach Investigation

After the 2025 Somalia e-visa data breach that exposed 35,000 people’s
data [^31], investigators would use disk forensics tools like Autopsy to: -
Image the compromised servers running the e-visa platform. - Analyze
web server logs to trace how hackers penetrated the system. - Recover
any deleted files that attackers may have tried to remove to cover their
tracks. - Perform keyword searches for attacker-created files, scripts, or
backdoors. - Build a timeline to determine the exact window of
unauthorized access and data exfiltration.
The government migrated the system to a new website afterward [^34], but
the forensic analysis of the original servers would be essential for the
investigation report.

5.7 Real-Life Context: Malawi Passport System Disk Analysis

When Malawi’s passport printing system was hijacked by ransomware [^36],
disk forensics using Autopsy would help investigators: - Identify the
ransomware executable and determine how it was delivered (email
attachment, exploit kit, etc.). - Trace which files were encrypted by
examining file modification timestamps. - Search for the ransom note file
(often named [Link] or similar). - Check for data exfiltration — did the
attackers steal data before encrypting it? - Recover any unencrypted copies
of critical files from unallocated disk space.

5.8 Real-Life Context: Kenya DCI Digital Forensics Investigations

Kenya’s DCI Cybercrime & Digital Forensics Lab conducts forensic analysis of
digital media containing evidence relevant to ongoing criminal investigations
[^44]. With the modern forensic tools donated by the German government
[^32], DCI investigators can use Autopsy and similar tools to investigate: -
Cybercrime cases involving disk evidence. - Financial fraud where
transaction records are stored on hard drives. - Terrorism-related
investigations requiring analysis of seized devices.