Endpoint Forensics Investigation Template
Case Information
| Field |
Value |
| Case ID |
|
| Incident Type |
|
| Target Endpoint |
|
| Investigation Date |
|
| Lead Investigator |
|
Evidence Inventory
| Evidence ID |
Type |
Source |
Hash (SHA256) |
Collection Time |
Collected By |
|
Memory dump |
|
|
|
|
|
Disk image |
|
|
|
|
|
Volatile data |
|
|
|
|
Chain of Custody
| Date/Time |
Action |
From |
To |
Notes |
|
Collected |
Endpoint |
Evidence storage |
|
Findings Summary
| Finding |
ATT&CK Technique |
Evidence |
Confidence |
| Initial access |
|
|
|
| Persistence |
|
|
|
| Lateral movement |
|
|
|
| Data access |
|
|
|
| Type |
Value |
Context |
| SHA256 |
|
|
| IP |
|
|
| Domain |
|
|
| File path |
|
|
Sign-Off
| Role |
Name |
Date |
| Lead Investigator |
|
|
| IR Manager |
|
|
mukul975