Digital Forensics

A reader with no background can begin with Windows Never Forgets (2026), which is written in plain language and says that no knowledge of forensics is needed to read it.[4] The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts (2025) serves the newcomer and the practitioner alike, as its subtitle says: its chapters are independent of one another, and they run from a first walkthrough of malware analysis and password cracking for beginners to the detection of altered network captures.[1] Students who need the surrounding skills first will find Linux commands for inspecting a machine and reviewing its logs in Linux Commands for Cybersecurity Students (2026),[15] and the tools of a security operations team, taught one to a chapter and then combined, in The Cybersecurity Field Guide: Hands-On Skills for Real-World Defense (2025).[14]

A working examiner will want EZ Tools Manuals (2025), a reference to be consulted tool by tool,[2] and, for how those tools came to be and what they do with the formats they read, Eric Zimmerman's Binary Foray (2023).[3]

The specialist books assume more. Memory Dump Analysis Anthology, Volume 1, Revised Edition opens with a part on crash dumps for beginners before its professional material,[6] Accelerated Linux Disassembly, Reconstruction and Reversing, Second Edition (2023) asks for a working knowledge of C and C++ and explains assembly language as it goes,[13] and Building GenAI Systems for DFIR (2026) is addressed to security practitioners, software architects and AI engineers.[5]

Computer forensics began in the 1980s, when police forces first had to examine seized personal computers, and took its settled form in the two decades that followed: the principle that an examiner works on a verified copy and never on the original, commercial suites of examination tools, and the accreditation of laboratories. The examination of a machine's working memory was added in the 2000s, and phones, cloud services and connected devices have since multiplied the places where evidence is kept.

The books record parts of this history at first hand. The community behind the crowdsourced guide began on IRC, moved to Discord, was at first a server for mobile forensics before it widened to the whole field, and in 2020 hosted a vendor's conference online.[1] The collected blog of one tool author is a record of years of tool-building, from the design of a registry parser through each release to the introduction of a tool for collection and triage, with an in-depth benchmark of four examination suites along the way.[3] The anthology of memory dump analysis reprints articles written from 2006 onwards,[6] and its most recent volume carries the series to November 2025.[11]

Forensic work starts from the copy. The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts has a chapter on forensic imaging, what a disk image is, how one is created and where the capture of memory fits, and another on artefacts as evidence, which sets the examiner's work within forensic science and distinguishes the artefact, the parsing that makes it readable, and the relation between an artefact and the evidence it supports. Its chapter on the law enforcement laboratory is about institutions more than technique: winning the cooperation of the organisation's leadership, the physical requirements of the laboratory, the choice of tools, certification and training, and accreditation.[1]

Data recovery is the neighbouring trade, applying the same knowledge of storage to a different end. The same guide divides it into logical and physical recovery and deals with the imaging of failing hard drives and with flash drives.[1] Best Free Open Source Data Recovery Apps for Mac OS English Edition (2024) is a short guide for Mac users to free, open-source recovery programs,[16] and the second volume of the dump analysis anthology, Memory Dump Analysis Anthology, Volume 2, Revised Edition, gives data recovery a part of its own, beside one on security.[7]

Most examinations are of Windows machines, and Windows is where the shelf is deepest. Windows Never Forgets explains in 44 chapters where the system's records live and how investigators read them: the histories kept in the registry, the Prefetch and Amcache records of programs that have run, the database of resource usage known as SRUM, the file system, event logs and event tracing, scheduled tasks, cloud services, stored credentials, and the Recall feature of recent versions. It treats these together with telemetry and privacy controls, so that it is as much about what a reader's own machine remembers as about investigation, and it takes June 2026 as its cut-off for changes in Windows.[4]

EZ Tools Manuals is the official manual of a set of free tools, most of which read one such record each. The command-line tools have a chapter apiece in a fixed form, an introduction, the switches, examples of commands, the output and the points to remember, and their names give the range: parsers for Amcache and the application compatibility cache, for event logs, for jump lists and shortcut files, for the master file table, for Prefetch, for the recycle bin, for the registry and its record of opened folders, for SQLite databases, for SRUM and for the Windows timeline, with a tool for mounting volume shadow copies. The graphical tools include explorers for the registry, the file table and timelines, and a hashing utility. The opening chapters deal with the switches the tools share and with the difference between running them from PowerShell and from the command prompt.[2]

Eric Zimmerman's Binary Foray reprints the blog posts in which the same tools were announced, and with them the explanations of the formats underneath: a series on the structure of registry hives down to the individual kinds of record, an example of recovering deleted registry records, a study of jump lists written so that examiners understand what their tools are and are not doing, and accounts of how the application compatibility cache changed in Windows 10 and how parsers coped with it.[3] Read together, the manual says how to run a tool and the blog says why its output can be believed.

An incident rarely involves one machine, and an examiner cannot image every disk on a network. The crowdsourced guide's chapter on triage asks what triage is and what a collection should include, and then scales the answer up, from one host or a few, to a medium-sized subnet, to an entire network. A chapter on Android applications has the same shape, automated analysis, manual analysis and then the problem of scale, which it meets with the Autopsy forensic suite, the Jadx decompiler and Python.[1]

Other chapters widen the ground. One treats Linux as a platform for forensic work, one the forensics of connected devices, with its particular difficulties, the competencies it requires and the question of where a device's data is actually kept, and one the detection of modified packet captures, by checking that hardware and network addresses agree and that the traffic of the address-assignment, address-resolution, transport and name protocols is consistent. A chapter on the year 2023 seen from threat intelligence covers the ways intruders first got in, the power and the limits of incident response, and the takedown of the LockBit ransomware group as a case study in disrupting cybercrime.[1]

The Cybersecurity Field Guide: Hands-On Skills for Real-World Defense gives the view from a security operations team. Its preface argues that tools taught in isolation do not prepare anyone for an investigation, in which an analyst moves between cloud consoles, command lines, scripts and log queries within the same case; its chapters on AWS, Linux, Python, Splunk and SQL accordingly end in combined scenarios, the first of which is the investigation of a compromised web server and the second a hunt for indicators of malware.[14]

An investigation often turns on a single hostile file. The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts introduces malware analysis through its basic tools and one worked example, and gives a chapter to de-obfuscating PowerShell payloads, taking the disguises in turn: commands and inline expressions encoded in Base64, compressed content, the invoke operator, reversed strings, chained replacements and translation from character codes. Its chapter on password cracking for beginners, a task that arises whenever evidence is encrypted, covers what a password hash is, how hashes are extracted and identified, and attacks by brute force, by wordlist and by wordlist with rules.[1]

The dump analysis anthology treats malware as something recognised in memory. Its seventh volume has a part on malware analysis patterns that begins with a definition of malware and names the recurring signs: a fake module, packed code, patched code, the residue left before obfuscation, pointers that lead outside any module, and strings that give a hint.[9] The fifth has a short part on security, with articles on the exposure of passwords in crash dumps and on the crash dump analysis of defective malware.[8] Memory Dump Analysis Anthology, Volume 8b lists a part on memory forensics, a single article on malware as an artefact and its primary and secondary effects, and the articles in its sample show the habit of mind: an analyst working on an ordinary fault stops to inspect an executable region of memory for traces of injected or generated code, and finds only the system's own call stubs.[10]

Accelerated Linux Disassembly, Reconstruction and Reversing, Second Edition teaches the underlying skill on Linux, for both x64 and ARM64 processors: disassembly, the reconstruction of what a program was doing from a core dump, and reversing, in exercises with the GDB debugger. The first exercise in its sample reviews the fundamentals of assembly language and rebuilds a stack trace by hand. Its description names memory forensics and the analysis of vulnerabilities and malware among the uses of these techniques, beside debugging.[13]

A memory dump is a copy of what a process or a whole machine held in memory at one moment, and reading one is the common ground between the engineer who wants to know why a program crashed and the examiner who wants to know what was running. The seventeen volumes of the anthology that begins with Memory Dump Analysis Anthology, Volume 1, Revised Edition are written from the engineer's side. Each is a reference volume of revised and cross-referenced articles from the author's institute. The first gathers those of 2006 and 2007 into parts that run from crash dumps for beginners and professional analysis to reversing and reconstruction, security and tools, with an index of debugger commands, and its description says that the tool information was revised for Windows 10 while some articles are kept for historical reasons.[6]

The organising idea is a pattern language. A recurring finding is given a name, a spiking thread, hooked functions, and the first volume has one part for such patterns and another for anti-patterns, the recurring mistakes of analysts.[6] The catalogue grows with each volume, and a page in the front matter of the seventh counts it by kind, with crash dump patterns the most numerous, then patterns for traces and logs, for core dumps and for malware.[9] The audience each volume names is software, support and quality engineers first, and security researchers, reverse engineers and analysts of malware and memory forensics after them,[6][11] which is a fair guide to the proportions of the contents.

Accelerated macOS Core Dump Analysis, Third Edition (2022) applies the method to Apple's platform. It is the transcript of a training course with twelve exercises in analysing the core dumps of ARM64 processes with Xcode and the LLDB debugger, covering crashes, freezes, memory leaks and deadlocks through more than thirty of the named patterns, with a tutorial on ARM64 disassembly and a comparison with dump analysis on Windows for those who come from it. Its stated audience includes analysts of malware and memory forensics who have never used LLDB.[12]

Building GenAI Systems for DFIR takes up a question that has become pressing since coding assistants made it possible to produce a working application in minutes: how anyone is to know that such an application can be trusted. Its answer is that trustworthiness comes from architecture and not from better prompts, larger models or more elaborate frameworks, and it uses digital forensics and incident response as a continuous case study, building an investigation assistant that grows from a prototype driven by a single prompt into a governed system of agents. The three parts follow the usual progression, prompt engineering, retrieval-augmented generation and agentic AI, and every chapter begins with a specification written for a coding assistant to implement, on the view that the human architect remains responsible for the design.[5]

Each chapter introduces one of ten principles, and several of them restate in software terms what forensic practice has long required of people: to separate observation from interpretation, to preserve ambiguity instead of resolving it early, to separate evidence from general knowledge, to preserve provenance, to let memory store the state of an investigation and not its conclusions, and to hand to deterministic programs whatever they can compute. The last principle is that capability requires governance. The description is candid that the lesson is architectural and applies as well to medicine, finance or law, wherever generated output influences an important decision.[5]

Much of the field's teaching is done by practitioners for one another, and the library's principal book on the subject is an instance. The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts was written by members of one online community, was first released in August 2022 with an introduction and ten chapters, and is intended to reach about twenty; each chapter is a finished piece, and its profits are donated to a charity for missing and exploited children. One of its chapters recommends learning through capture-the-flag competitions, explaining what they are, what kinds exist, who hosts them and why a practitioner should play.[1]

The tool manual is kept in the same spirit: it is developed in a public repository where suggestions are invited, and it points its readers to material on the tools by their author and by the community.[2] Windows Never Forgets is free as a PDF under a Creative Commons licence and carries 175 technical references,[4] and Linux Commands for Cybersecurity Students states at the outset that its commands are for defensive and educational use in authorised laboratories and on the student's own machines.[15]