Context and scope
Investigation of a compromised workstation: memory, disk, documents, timeline, impacts and corrective measures.
Work performed
- Analyse memory, processes, connections and traces with Volatility.
- Acquire and analyse disk and artefacts with FTK Imager, MFT2CSV and Autopsy.
- Examine PDF and OLE documents; observe malicious behaviour in an isolated environment.
- Correlate the timeline, establish the infection vector and recommend response and prevention.
Documented deliverables and outcomes
Forensic method; incident report; timeline and artefacts; vector analysis; response recommendations.
Scope of outcomes
The reviewed public documents describe the work and deliverables above. They do not provide a quantified before/after series supporting a risk-reduction percentage here.
Methods and tools
Volatility · FTK Imager · Autopsy · MFT2CSV · PDFid / pdf-parser · OLEdump
Public scope
Client data, exploitable configurations and proprietary mechanisms remain excluded from this presentation.
Last reviewed: 26 October 2026
Discuss this work