LT EN

02 — Methodology

Investigation stages and tools

The NIST SP 800-86 model, adapted to the Lithuanian legal environment. Six sequential stages from the incident to the expert's conclusion, plus a practical tool arsenal.

  1. 01

    Identification

    The incident is detected; potential evidence sources are mapped: computers, mobile devices, cloud accounts, IoT, network, cameras.

    • Incident definition
    • Source mapping
    • Prioritisation
  2. 02

    Preservation

    The evidence is „frozen": media is isolated, rotation is stopped, a memory dump is captured, the scene is photographed.

    • Write-blocker
    • Live RAM dump
    • Evidence seals
  3. 03

    Collection

    A bit-by-bit image is created (E01, dd, AFF4). Hash values are computed before and after copying.

    • FTK Imager / dd / Guymager
    • SHA-256 verification
    • Two copies: working and archival
  4. 04

    Examination

    Artifacts are extracted: deleted file recovery, browser history, registry keys, scheduled tasks, MFT, $LogFile.

    • Autopsy / X-Ways / EnCase
    • Plaso / log2timeline
    • Volatility — RAM
  5. 05

    Analysis

    An event chronology (super-timeline) is constructed, artifacts are correlated, and hypotheses are formed and tested.

    • Super-timeline
    • IOC correlations
    • MITRE ATT&CK mapping
  6. 06

    Presentation

    An expert conclusion is produced — clear, reproducible, defensible in court. Facts, assumptions and opinions are kept separate.

    • Expert conclusion
    • Appellate resilience
    • Visualisations for the jury

Tool arsenal

Practical tools

Industry standards and open-source tools used by practising investigators.

AutopsyDisk analysis
FTK ImagerImaging
Volatility 3RAM analysis
WiresharkNetwork traffic
PlasoSuper-timeline
KAPETriage
VelociraptorEDR / hunt
YARASignatures
CellebriteMobile
ChainalysisBlockchain
MaltegoOSINT graph
ZeekNSM
GhidraReverse
IDA ProReverse
SuricataIDS/IPS
ArkimeFull PCAP