Case files
← Case index

CASE./002

Digital forensics

NIST CFReDS Hacking Case

Analyzed and hash-verified a NIST CFReDS forensic disk image to reconstruct system activity and identify recoverable evidence across Windows host, user, network, email, and IRC artifacts.

Date
September 2026
Scope
Windows host, user, network, email, and IRC artifacts
Tools
FTK Imager, Autopsy, Registry Explorer, Wireshark
Output
Documented findings and evidence trail

01 / Objective

Answer the case without losing the evidence trail.

Investigation brief

I examined a NIST CFReDS forensic image to identify relevant system activity, establish a timeline, and support each conclusion with recoverable artifacts rather than assumption.

02 / Method

A repeatable path from image to finding.

VerifyHash-verify the forensic disk image.
SurveyReview the file system and build a timeline.
ExamineInspect registry, host, and network artifacts.
CorrelateConnect timestamps and activity across sources.
ReportMap every conclusion back to evidence.

03 / Tool-to-question map

Each tool had a specific investigative job.

FTK Imager
Inspect the forensic disk image and verify its hash.
Autopsy
Examine file-system artifacts and timeline events.
Registry Explorer
Review Windows Registry artifacts.
Wireshark
Examine packet evidence and relate network activity to host events.

04 / Evidence record

Make the reasoning reproducible.

The value of the exercise was not only finding artifacts; it was preserving enough context for another analyst to follow the same path.

Evidence discipline

  • Hash verification and evidence handling
  • Investigative steps and artifact correlations
  • Investigation timeline

Reporting discipline

  • Observation separated from interpretation
  • Conclusions tied to artifacts
  • Clear limits where evidence was incomplete

05 / Skills demonstrated

Good forensic work is a chain of documented decisions, not a list of tool outputs.

This case developed evidence handling, timeline analysis, Windows artifact review, packet analysis, cross-source correlation, and concise technical reporting.