03 / Digital forensics
I examine digital artefacts to understand user and system activity, investigate suspicious behaviour, and connect findings across different sources of evidence.
My capabilities
My practical work spans supplied disk images, Windows registry artefacts, network traffic, and memory dumps. FTK Imager was my main tool for disk-image examination, alongside Autopsy. I also used FTK Imager to create a custom evidence image and verify its integrity using MD5 and SHA-1 hashes.
I used Wireshark to examine captured network traffic and investigate suspicious web activity in a simulated web-server attack.
Practical experience
Practical investigations using supplied academic evidence and simulated scenarios.
01 / Windows artefacts
I used AccessData Registry Viewer to examine Windows user-registry data for records of user and application activity.
This helped me navigate registry structures and assess how recorded activity can provide leads for an investigation.
02 / Application memory
I used Volatility 3 to locate application processes in a supplied Windows memory dump and search extracted strings for unsaved text.
This demonstrates my ability to locate relevant processes and recover application content that may be absent from files on disk.
03 / Evidence correlation
I used Volatility 3 to compare process information, command lines, and file mappings to investigate an executable’s location and its relationship to a network share.
This demonstrates my ability to connect multiple artefacts and draw conclusions supported by the evidence.
Forensic readiness
I also proposed a network design for a hypothetical organisation with multiple offices. I planned security-control placement and centralised logging to support future investigations, explaining how access records, firewall logs, and VPN activity could provide useful evidence.
The design combined public cloud services with a private data centre, alongside a long-term cost estimate.
What I learned
These investigations taught me to choose suitable tools for different types of digital evidence, compare findings, and recognise when more evidence is needed before drawing a conclusion. They also strengthened my ability to explain findings clearly and identify what requires further investigation.