SANS DFIR Posters and Cheat Sheets
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A download library of reference posters and cheat sheets, of which 37 are filed under Digital Forensics and Incident Response — artifact maps, timestamp reference tables, tool command references and filter syntax sheets. Download requires a free SANS account rather than payment.
Who it is for, and when
These are the single most reused free SANS artefacts: the Windows forensic analysis and timestamp reference sheets answer in ten seconds what would otherwise be a documentation hunt, and they are accurate enough to work from during an examination. Print them. Recent additions include a Timestamp Audit Checklist.
What it does not cover
They are reference cards, not training — no explanation, no exercises, no methodology. They also function as advertising for the corresponding paid SANS course, and coverage follows the course catalogue rather than the field.
Go to the source
Open at sans.org (opens in a new tab)https://www.sans.org/posters/
Details
- Type
- Free training
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Topics
- free-training, windows, timeline, registry, memory-forensics, vendor-content
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
A scripted corporate scenario covering the first four weeks of a fictional patent-search company, from 13 November 2009 to 12 December 2009. It ships daily hard drive images and daily RAM captures for each computer, USB drive images, inbound and outbound packet captures, final-day images of every system, and simulated case paperwork including detective reports, warrants and affidavits.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box, timeline construction and artifact correlation. Written as a bench manual rather than a textbook.