What's on My DFIR Box?

By popular request, this episode provides a walkthrough of the hardware and software I utilize for my digital forensic workstation. While this is probably more beneficial for people new to the DFIR field, I suspect it will still be interesting to a wide range of viewers.

📖 Chapters

00:00 - Intro
01:42 - Windows Subsystem for Linux (WSL) 2
03:18 - Windows Terminal
04:39 - Sysinternals Suite
05:31 - Microsoft PowerToys
06:20 - DCode
07:04 - FTK Imager
07:31 - PST Walker
08:53 - Arsenal Image Mounter
09:35 - Hibernation Recon
10:05 - Kroll Artifact Parser and Extractor (KAPE)
10:42 - NirSoft Tools
11:49 - X-Ways Forensics
12:19 - Eric Zimmerman Tools
14:09 - Chainsaw
14:21 - INDXRipper
14:26 - RegRipper
15:09 - balenaEtcher
15:49 - Sysinternals Suite (RDCMan)
17:12 - Visual Studio Code

#HomeLabs #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[alexismerritt]

Within our community, we're often met with smoke screens or 'it depends' answers on how to get started. A quick walkthrough of your base tooling is exceptional, and I hope this video receives multitudes of views from aspiring, junior, mid, and even senior-level DFIR folks. - Thank you for sharing with all of us!

[satyammishra]

Please make a video on X-ways using various X-tensions for analysis

[Lokiwho]

I love powertoys, particularly for the FancyZones

[CookieBrainSlug]

Great video! Definitely a treasure trove of awesome tools!

Got any tools for analyzing files found in macOS and iOS such as SQLite databases and Plist files? I like DB Browser for SQLite.

[cozawone]

Any hex editor that you use or recommend? Free or paid.

[cheesee]

Quick question! Why not magnet axiom? :O

[TankCatIntoMordor]

*slaps computer case* you wont be able to afford this

[avihayl]

Thanks for the thorough explanation!
So do you have personal information on this PC such as logged in sessions to your email, microsoft account etc? Are you using this PC for personal use as well?
Additionally, where and how do you analyze/run malware? (statically and dynamically)?
finally, do you know how can I RDP to malware forensics box without jeopardizing my own personal laptop?
Thanks!

[TurbYoda]

Have you tried running the 980 pros in RAID 0?- I've been really happy with that with my r9 5950x system.

[centralcybersecurity]

How about MacBook Pro M1 Chip - using Windows along side as dual boot - would that be good enough for a DFIR Box or a separate Windows laptop is necessary?

[PrinterJamOnToast]

Interesting, so you don't run your tools in a VM?

[jh]

Why such a beefy GPU for a forensics box? The only thing I can think of is password cracking (a single 3090 is not ideal for this outside of some basic NTLMv1 hashing). Do you game on this device? Would you dual boot two instances of Windows 11?

Genuinely curious, I have always gone the prebuild HP Z workstation route for the higher core Xeon boxes and then midrange GPUs (2060/3060) for some CUDA stuff that tools like Magnet Axiom can use for image recognition or other light GPU beneficial workloads.