IR & DFIR Triage

Triage, first 15 minutes: Is it real? What's the scope? Is it ongoing? Asset criticality? Escalate? Write findings as you go, timestamped — memory is unreliable and incidents get reviewed.

Order of volatility (collect top-down):

registers/cache → RAM → network state → processes → disk → remote logs → archival.

Practical consequence: don't reboot a suspected compromised host. You destroy memory — often the only place fileless malware and in-memory credentials exist.

Containment trade-off: network-isolate while leaving powered on is the sane default — it stops spread while preserving RAM. Powering off destroys volatile evidence. Deviate deliberately, and write down why.

Evidence: hash on acquisition (SHA-256), work on copies, chain of custody, UTC always.

Timelines separate artefact (fact) from interpretation (inference) and state confidence. Analysts who blur those get burned in review.

Eradication fails when it treats symptoms. Deleting the webshell doesn't matter if the vulnerable upload endpoint remains. Always drive to initial access.