digital-forensics
ZHTrace security incidents from preserved evidence.
What it does
Analyzes incident evidence to produce forensic timelines, findings, and remediation recommendations while preserving originals.
When to use it
Use for authorized investigations involving memory dumps, disk timelines, network captures, artifact triage, or incident-response evidence preservation.
How to use it
Give it incident evidence; it returns forensic findings, an evidence-linked timeline, and remediation recommendations.
What you provide
- Your files
What you need · 5
The memory-analysis workflow calls vol to inspect system information, processes, network connections, and command lines.
The network-analysis workflow uses tshark to summarize sessions and DNS in packet captures.
Routes exported suspicious network streams to protocol-reverse for further analysis; whether installing it is required to complete the workflow is unstated.
Routes deeper analysis of malicious samples to malware-analysis; whether installing it is required to complete the workflow is unstated.
Access · 0
No additional actions listed.