A practitioner's guide to DFIR methodology: capturing volatile evidence in the correct order, imaging disks and memory without corrupting them, and turning a Volatility 3 memory dump and a plaso super-timeline into a defensible incident narrative.
Dfir
-
Digital Forensics and Memory Analysis