In this module
IR1.1 The Forensic Workstation
Operational Objective
The Contamination Problem: if you run forensic analysis on the same machine the attacker compromised, your analysis artifacts contaminate the evidence. Every file you open modifies the $MFT. Every tool you install changes the registry. Every query you run creates Prefetch entries. The forensic workstation must be a separate, clean environment dedicated to analysis — never used for daily work, never exposed to compromised evidence without isolation controls.
Deliverable: A fully configured forensic workstation — physical or virtual — with a standardized folder structure, verified tool installations, and isolation controls that prevent evidence contamination.
⏱ Estimated completion: 20 minutes
The Forensic Workstation
Your investigation starts here — before any tool touches evidence
The first mistake most new responders make is running forensic tools on their daily-use workstation. The defense attorney asks: "How do you know the malware you found came from the suspect's computer and not from your own machine?" If you cannot answer that question with certainty, the evidence is compromised. A dedicated forensic workstation — isolated from production, configured specifically for analysis — eliminates that risk before it arises.
Evidence integrity is the foundation of every investigation. A finding that cannot withstand scrutiny — because the analyst's own activity contaminated the timeline, because tools were installed on the evidence drive, because the chain of custody was broken by copying files to a shared workstation — is a finding that fails in court, fails in the IR report, and fails to support the containment decision it was meant to justify.
# Multi-case workspace: each case gets its own root directory
# The folder structure from the course standard:
# Case 1: AiTM phishing investigation
# C:\IR\Cases\INC-NE-2026-0315-001\
# Evidence\ ← raw KAPE output, memory dumps, Velociraptor downloads
# Output\ ← parsed EZTools results, Volatility 3 analysis
# Timeline\ ← unified investigation timeline
# IOCs\ ← indicators extracted during investigation
# Report\ ← IR report drafts and final deliverable
# Notes\ ← investigator notes, hypothesis log
# Case 2: Insider threat investigation (concurrent)
# C:\IR\Cases\INC-NE-2026-0312-003\
# Evidence\
# Output\
# Timeline\
# IOCs\
# Report\
# Notes\
# NEVER share files between case directories
# NEVER open evidence from one case while another case's
# Timeline Explorer session is active (cross-contamination risk)
# If using a VM: consider separate VM snapshots per case# Create the standard forensic workstation folder structure
# Run in PowerShell as Administrator
# Root forensic directory
New-Item -ItemType Directory -Path "C:\IR" -Force
# Tools directory — all forensic tools installed here
New-Item -ItemType Directory -Path "C:\IR\Tools" -Force
New-Item -ItemType Directory -Path "C:\IR\Tools\KAPE" -Force
New-Item -ItemType Directory -Path "C:\IR\Tools\EZTools" -Force
New-Item -ItemType Directory -Path "C:\IR\Tools\Velociraptor" -Force
New-Item -ItemType Directory -Path "C:\IR\Tools\Volatility3" -Force
New-Item -ItemType Directory -Path "C:\IR\Tools\Scripts" -Force
# Cases directory — one folder per investigation
New-Item -ItemType Directory -Path "C:\IR\Cases" -Force
# Evidence directory — collected evidence stored here
New-Item -ItemType Directory -Path "C:\IR\Evidence" -Force
# Output directory — parsed results and reports
New-Item -ItemType Directory -Path "C:\IR\Output" -Force
# Templates directory — IR report templates, checklists
New-Item -ItemType Directory -Path "C:\IR\Templates" -Force
Write-Host "Forensic workstation folder structure created." -ForegroundColor Green
Write-Host "Tools: C:\IR\Tools\" -ForegroundColor Cyan
Write-Host "Cases: C:\IR\Cases\" -ForegroundColor Cyan
Write-Host "Evidence: C:\IR\Evidence\" -ForegroundColor Cyan
Write-Host "Output: C:\IR\Output\" -ForegroundColor Cyan
Write-Host "Templates: C:\IR\Templates\" -ForegroundColor Cyan# Validate the forensic workstation environment
# Run in PowerShell as Administrator
Write-Host "=== Forensic Workstation Validation ===" -ForegroundColor Cyan
# Check OS version
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "OS: $($os.Caption) $($os.Version)" -ForegroundColor White
# Check RAM
$ram = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1)
if ($ram -ge 32) {
Write-Host "RAM: ${ram} GB — Recommended" -ForegroundColor Green
} elseif ($ram -ge 16) {
Write-Host "RAM: ${ram} GB — Minimum (Volatility 3 may be slow on large dumps)" -ForegroundColor Yellow
} else {
Write-Host "RAM: ${ram} GB — BELOW MINIMUM. Upgrade to 16+ GB." -ForegroundColor Red
}
# Check free disk space
$disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"
$freeGB = [math]::Round($disk.FreeSpace / 1GB, 1)
if ($freeGB -ge 200) {
Write-Host "Free disk: ${freeGB} GB — Recommended" -ForegroundColor Green
} elseif ($freeGB -ge 100) {
Write-Host "Free disk: ${freeGB} GB — Minimum" -ForegroundColor Yellow
} else {
Write-Host "Free disk: ${freeGB} GB — LOW. Free space before proceeding." -ForegroundColor Red
}
# Check PowerShell version
Write-Host "PowerShell: $($PSVersionTable.PSVersion)" -ForegroundColor White
# Check .NET version (required for EZTools)
$dotnet = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" -ErrorAction SilentlyContinue
if ($dotnet) {
$release = $dotnet.GetValue("Release")
Write-Host ".NET Framework: Release $release — OK" -ForegroundColor Green
} else {
Write-Host ".NET Framework 4.x: NOT FOUND — required for EZTools" -ForegroundColor Red
}
# Check Python (required for Volatility 3)
try {
$pyVer = python --version 2>&1
Write-Host "Python: $pyVer" -ForegroundColor Green
} catch {
Write-Host "Python: NOT FOUND — install Python 3.10+ for Volatility 3" -ForegroundColor Yellow
}
# Check folder structure
$paths = @("C:\IR\Tools", "C:\IR\Cases", "C:\IR\Evidence", "C:\IR\Output", "C:\IR\Templates")
foreach ($p in $paths) {
if (Test-Path $p) {
Write-Host "Directory: $p — EXISTS" -ForegroundColor Green
} else {
Write-Host "Directory: $p — MISSING (run folder creation script)" -ForegroundColor Red
}
}
Write-Host "`n=== Validation Complete ===" -ForegroundColor Cyan# Create a case folder for a new investigation
# Use this template at the start of every case
function New-IRCase {
param(
[Parameter(Mandatory)][string]$CaseID,
[string]$Description = "New investigation"
)
$casePath = "C:\IR\Cases\$CaseID"
$dirs = @("Evidence", "Output", "Notes", "Report", "Timeline", "IOCs")
foreach ($dir in $dirs) {
New-Item -ItemType Directory -Path "$casePath\$dir" -Force | Out-Null
}
# Create case log
$log = @"
Case ID: $CaseID
Created: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC' -AsUTC)
Analyst: $env:USERNAME
Description: $Description
Status: Open
--- EVIDENCE LOG ---
[Record every evidence item received, its source, hash, and custody transfer]
--- INVESTIGATION NOTES ---
[Chronological notes as the investigation progresses]
"@
$log | Out-File "$casePath\case_log.txt"
Write-Host "Case created: $casePath" -ForegroundColor Green
}
# Usage: New-IRCase -CaseID "INC-NE-2026-0315-001" -Description "AiTM phishing - jmorrison"# Exclude the forensic tools directory from Windows Defender scanning
# Run as Administrator
Add-MpPreference -ExclusionPath "C:\IR\Tools"
Add-MpPreference -ExclusionPath "C:\IR\Evidence"
Add-MpPreference -ExclusionPath "C:\IR\Output"
# Verify exclusions
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath# Add forensic tools to the system PATH
# Run as Administrator
$currentPath = [Environment]::GetEnvironmentVariable("Path", "Machine")
$newPaths = @(
"C:\IR\Tools\KAPE",
"C:\IR\Tools\EZTools",
"C:\IR\Tools\Volatility3\venv\Scripts",
"C:\IR\Tools\Velociraptor",
"C:\IR\Tools\Scripts"
)
foreach ($p in $newPaths) {
if ($currentPath -notlike "*$p*") {
$currentPath = "$currentPath;$p"
}
}
[Environment]::SetEnvironmentVariable("Path", $currentPath, "Machine")
# Restart PowerShell for the PATH change to take effect
# After restart, verify:
# kape.exe --help
# PECmd.exe --help
# vol --help# Set the forensic workstation to UTC
# Run as Administrator
Set-TimeZone -Id "UTC"
# Verify
Get-TimeZone
# Expected: (UTC) Coordinated Universal Time# Complete prerequisite verification script
# Run after OS installation, before tool installation
Write-Host "=== Forensic Workstation Prerequisites ===" -ForegroundColor Cyan
# 1. .NET Framework 4.6.2+ (required for EZTools legacy builds)
$dotnet = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" -ErrorAction SilentlyContinue
$release = if ($dotnet) { $dotnet.Release } else { 0 }
$dotnetOk = $release -ge 394802 # 4.6.2
Write-Host ".NET Framework 4.6.2+: $(if ($dotnetOk) { 'OK (Release ' + $release + ')' } else { 'MISSING — install from Microsoft' })" -ForegroundColor $(if ($dotnetOk) { 'Green' } else { 'Red' })
# 2. .NET 6+ Runtime (required for newer EZTools builds)
$dotnet6 = dotnet --list-runtimes 2>&1
$has6 = $dotnet6 -match "Microsoft.NETCore.App 6\.|Microsoft.NETCore.App 7\.|Microsoft.NETCore.App 8\.|Microsoft.NETCore.App 9\."
Write-Host ".NET 6+ Runtime: $(if ($has6) { 'OK' } else { 'MISSING — install .NET Desktop Runtime from dotnet.microsoft.com' })" -ForegroundColor $(if ($has6) { 'Green' } else { 'Red' })
# 3. Python 3.10+ (required for Volatility 3)
try {
$pyVer = python --version 2>&1
$pyOk = $pyVer -match "3\.(1[0-9]|[2-9][0-9])"
Write-Host "Python: $pyVer $(if ($pyOk) { '— OK' } else { '— upgrade to 3.10+' })" -ForegroundColor $(if ($pyOk) { 'Green' } else { 'Yellow' })
} catch {
Write-Host "Python: NOT FOUND — install from python.org (check Add to PATH)" -ForegroundColor Red
}
# 4. Git (for KAPE sync and Volatility source install)
try {
$gitVer = git --version 2>&1
Write-Host "Git: $gitVer — OK" -ForegroundColor Green
} catch {
Write-Host "Git: NOT FOUND — install from git-scm.com (optional but recommended)" -ForegroundColor Yellow
}
# 5. PowerShell 5.1+ (included with Windows 10/11)
Write-Host "PowerShell: $($PSVersionTable.PSVersion) — OK" -ForegroundColor Green
# 6. Disk space
$disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"
$freeGB = [math]::Round($disk.FreeSpace / 1GB, 1)
$diskOk = $freeGB -ge 100
Write-Host "Free disk: ${freeGB} GB $(if ($diskOk) { '— OK' } else { '— LOW, need 100+ GB' })" -ForegroundColor $(if ($diskOk) { 'Green' } else { 'Red' })
# 7. RAM
$ram = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 1)
$ramOk = $ram -ge 16
Write-Host "RAM: ${ram} GB $(if ($ramOk) { '— OK' } else { '— need 16+ GB for Volatility 3' })" -ForegroundColor $(if ($ramOk) { 'Green' } else { 'Red' })
Write-Host "`n=== Resolve any RED items before proceeding to IR1.2 ===" -ForegroundColor CyanCompliance Myth
"A virtual machine is not suitable for forensic analysis."
Production reality: The concern about VMs in forensics relates to evidence acquisition — running a forensic tool inside a VM on the compromised host could allow a hypervisor-aware rootkit to hide evidence. That concern does not apply to the analysis workstation. The forensic workstation is where you analyze evidence that was already collected from the compromised system. Whether your analysis environment is physical or virtual does not affect the integrity of the evidence — the evidence was collected before it reached the workstation. A VM with a clean snapshot is actually an advantage: you can restore to a known-good state between investigations, preventing cross-case contamination.
Build it: Set up your forensic workstation
Dedicate a machine (physical or VM) for forensic analysis
Dedicate a machine (physical or VM) for forensic analysis. Run the folder creation script. Run the validation script. Resolve any red items. If using a VM, take a snapshot after completing the full tool installation in subsections IR1.2-IR1.5 — label it "IR Baseline" so you can restore to a clean, tool-ready state at any time. This workstation is your investigation platform for the rest of the course and every future investigation.
Beyond this investigation
The techniques taught in this subsection apply beyond the specific scenario presented here. The same evidence sources, tools, and analytical methods are used across ransomware, BEC, insider threat, and APT investigations — the context changes but the methodology is consistent.
Decision point
You discover evidence that the attacker has been in the environment for 90 days. The CISO asks: 'Why did our SOC not detect this sooner?' How do you answer constructively?
Answer with facts, not defensiveness. 'The attacker used [specific techniques] that our current detection rules do not cover. The investigation identified [N] detection gaps — [list the specific ATT&CK techniques that were not detected]. The IR-to-DE handoff includes these gaps as detection engineering sprint items. Estimated time to close: [N weeks].' This answer is honest (we missed it), specific (here is what we missed and why), and forward-looking (here is how we fix it). The PIR action items transform the detection failure into a measurable improvement program.
© 2026 Ridgeline Cyber Defence™ Ltd. Content may not be reproduced or redistributed. Worked artifacts may be adapted for use within your organization.