> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/forensics/basic-forensic-methodology.md).

# Basic Forensic Methodology

In this section of the book we are going to learn about some **useful forensics tricks**.\
We are going to talk about partitions, file-systems, carving, memory, logs, backups, OSs, and much more.

So if you are doing a professional forensic analysis to some data or just playing a CTF you can find here useful interesting tricks.

## Creating and Mounting an Image

{% content-ref url="/pages/-MaoHEtKgU30C2woP96L" %}
[Image Adquisition & Mount](/githubimport/forensics/basic-forensic-methodology/image-adquisition-and-mount.md)
{% endcontent-ref %}

## Malware Analysis

This **isn't necessary the first step to perform once you have the image**. But you can use this malware analysis techniques independently if you have a file, a file-system image, memory image, pcap... so it's good to **keep these actions in mind**:

{% content-ref url="/pages/-MaoHEtMT8G9sFcGPuG3" %}
[Malware Analysis](/githubimport/forensics/basic-forensic-methodology/malware-analysis.md)
{% endcontent-ref %}

## Inspecting an Image

if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in:

{% content-ref url="/pages/-MaoHEtPnGVwNT4j\_ryB" %}
[Partitions/File Systems/Carving](/githubimport/forensics/basic-forensic-methodology/partitions-file-systems-carving.md)
{% endcontent-ref %}

Depending on the used OSs and even platform different interesting artifacts should be searched:

{% content-ref url="/pages/-MaoHEtg6\_Z\_mKyjalWa" %}
[Windows Artifacts](/githubimport/forensics/basic-forensic-methodology/windows-forensics.md)
{% endcontent-ref %}

{% content-ref url="/pages/-MaoHEtLllDS9twkk8aF" %}
[Linux Forensics](/githubimport/forensics/basic-forensic-methodology/linux-forensics.md)
{% endcontent-ref %}

{% content-ref url="/pages/-MaoHEtJF9mGs2lvO5ec" %}
[Docker Forensics](/githubimport/forensics/basic-forensic-methodology/docker-forensics.md)
{% endcontent-ref %}

## Deep inspection of specific file-types and Software

If you have very **suspicious** **file**, then **depending on the file-type and software** that created it several **tricks** may be useful.\
Read the following page to learn some interesting tricks:

{% content-ref url="/pages/-MaoHEtXu-egAoO8yQDP" %}
[Specific Software/File-Type Tricks](/githubimport/forensics/basic-forensic-methodology/specific-software-file-type-tricks.md)
{% endcontent-ref %}

I want to do a special mention to the page:

{% content-ref url="/pages/-MaoHEtZ2NoskLLC481j" %}
[Browser Artifacts](/githubimport/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md)
{% endcontent-ref %}

## Memory Dump Inspection

{% content-ref url="/pages/-MaoHEtNzil2OxlpopUz" %}
[Memory dump analysis](/githubimport/forensics/basic-forensic-methodology/memory-dump-analysis.md)
{% endcontent-ref %}

## Pcap Inspection

{% content-ref url="/pages/-MaoHEtS66v5\_nSxXGWS" %}
[Pcap Inspection](/githubimport/forensics/basic-forensic-methodology/pcap-inspection.md)
{% endcontent-ref %}

## **Anti-Forensic Techniques**

Keep in mind the possible use of anti-forensic techniques:

{% content-ref url="/pages/-MaoHEtIjuqLYfmV-rdz" %}
[Anti-Forensic Techniques](/githubimport/forensics/basic-forensic-methodology/anti-forensic-techniques.md)
{% endcontent-ref %}