# Endpoint Forensics Investigation Template

## Case Information

| Field | Value |
|-------|-------|
| Case ID | |
| Incident Type | |
| Target Endpoint | |
| Investigation Date | |
| Lead Investigator | |

## Evidence Inventory

| Evidence ID | Type | Source | Hash (SHA256) | Collection Time | Collected By |
|-------------|------|--------|---------------|-----------------|-------------|
| | Memory dump | | | | |
| | Disk image | | | | |
| | Volatile data | | | | |

## Chain of Custody

| Date/Time | Action | From | To | Notes |
|-----------|--------|------|-----|-------|
| | Collected | Endpoint | Evidence storage | |

## Findings Summary

| Finding | ATT&CK Technique | Evidence | Confidence |
|---------|------------------|----------|------------|
| Initial access | | | |
| Persistence | | | |
| Lateral movement | | | |
| Data access | | | |

## IOCs Extracted

| Type | Value | Context |
|------|-------|---------|
| SHA256 | | |
| IP | | |
| Domain | | |
| File path | | |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| Lead Investigator | | |
| IR Manager | | |
