mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-29 15:40:58 +03:00
66 lines
1.7 KiB
Markdown
66 lines
1.7 KiB
Markdown
# EZ Tools Forensic Analysis Report Template
|
|
|
|
## Case Information
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Case Number | |
|
|
| Examiner | |
|
|
| Date of Analysis | |
|
|
| Evidence Source | |
|
|
| Evidence Hash (SHA-256) | |
|
|
| EZ Tools Version | |
|
|
|
|
## Artifacts Processed
|
|
|
|
| Artifact | Tool Used | Status | Records Parsed |
|
|
|----------|-----------|--------|----------------|
|
|
| $MFT | MFTECmd | | |
|
|
| $J (USN Journal) | MFTECmd | | |
|
|
| Prefetch Files | PECmd | | |
|
|
| LNK Files | LECmd | | |
|
|
| Jump Lists | JLECmd | | |
|
|
| Event Logs | EvtxECmd | | |
|
|
| Registry Hives | RECmd | | |
|
|
| Shellbags | SBECmd | | |
|
|
| Recycle Bin | RBCmd | | |
|
|
| Amcache | AmcacheParser | | |
|
|
| ShimCache | AppCompatCacheParser | | |
|
|
|
|
## Key Findings
|
|
|
|
### Program Execution Evidence
|
|
| Executable | First Execution | Last Execution | Run Count | Source |
|
|
|-----------|----------------|---------------|-----------|--------|
|
|
| | | | | |
|
|
|
|
### Timestomping Indicators
|
|
| File | $SI Created | $FN Created | Anomaly |
|
|
|------|------------|------------|---------|
|
|
| | | | |
|
|
|
|
### User Activity Timeline
|
|
| Timestamp | Activity | Artifact Source | Details |
|
|
|-----------|----------|----------------|---------|
|
|
| | | | |
|
|
|
|
### Lateral Movement Indicators
|
|
| Timestamp | Source IP | Target System | Logon Type | Event ID |
|
|
|-----------|----------|--------------|------------|----------|
|
|
| | | | | |
|
|
|
|
### USB Device Connections
|
|
| Device | Serial Number | First Connected | Last Connected | Volume Name |
|
|
|--------|--------------|----------------|---------------|-------------|
|
|
| | | | | |
|
|
|
|
## Conclusion
|
|
|
|
_(Summary of findings based on artifact analysis)_
|
|
|
|
## Chain of Custody
|
|
|
|
| Date/Time | Action | Performed By | Notes |
|
|
|-----------|--------|-------------|-------|
|
|
| | | | |
|