Chapter 3

DFIR Lab Setup

What a working DFIR analysis environment looks like — hardware requirements, essential tools, VM configuration, network isolation, and the REMnux + SIFT Workstation toolkit that covers 90% of forensic analysis needs.

Scenario

You've collected a 32 GB RAM image, a 500 GB disk image, and a KAPE triage package from a compromised server. Now you need to analyze them. Your analysis environment must be: isolated from production (malware samples shouldn't phone home during analysis), powerful enough to handle multi-gigabyte files efficiently, equipped with the right tools for each artifact type, and organized so you can reproduce your findings from notes alone. This chapter builds the lab that makes all of that possible.

Hardware Requirements

Component	Minimum	Recommended	Reason
RAM	16 GB	64 GB	Volatility 3 loads the entire memory image into address space. A 32 GB memory image needs >32 GB of analysis RAM. Running multiple VMs compounds this.
CPU	8 cores	16+ cores	Autopsy's background ingestion, Volatility plugin scans, and Log2timeline can all run in parallel. More cores = faster analysis.
Storage	2 TB SSD	4-8 TB NVMe SSD	A single case can easily be 1 TB: disk image + RAM + analysis output. Fast NVMe dramatically speeds up disk image processing.
Network	Isolated VLAN or airgap	Dedicated airgapped analysis workstation + separate internet-connected sandbox	Malware samples must not have network access during analysis. An airgapped primary workstation with a separate sandbox VM for detonation covers this cleanly.

Core Toolkits

  DFIR Toolkit Architecture
  ═══════════════════════════════════════════════════════════════════

  Host OS (Windows or Linux analysis workstation)
  ├── SIFT Workstation (Ubuntu-based, SANS DFIR VM)
  │   ├── Autopsy + Sleuth Kit        — disk image analysis
  │   ├── Volatility 3                — memory forensics
  │   ├── Plaso / Log2timeline        — timeline creation
  │   ├── Timesketch                  — timeline analysis UI
  │   ├── Sleuth Kit (fls, icat, etc) — raw filesystem tools
  │   └── Eric Zimmermann Tools       — Windows artifact parsers
  │
  ├── REMnux (Ubuntu-based, malware analysis VM)
  │   ├── FLOSS / strings             — static string extraction
  │   ├── Ghidra / Cutter             — reverse engineering
  │   ├── Wireshark / NetworkMiner    — PCAP analysis
  │   ├── inetsim                     — network simulation for malware
  │   ├── YARA                        — pattern matching on samples
  │   └── Capa                        — capability detection in binaries
  │
  ├── Windows Analysis VM (for Windows artifact parsing)
  │   ├── Eric Zimmermann (EZ) Tools  — native Windows environment
  │   ├── RegRipper                   — registry analysis
  │   ├── KAPE                        — artifact collection + parsing
  │   └── Arsenal Image Mounter       — mount E01/VHD images for browsing
  │
  └── Evidence Storage
      ├── Dedicated RAID-6 NAS for image storage
      └── Evidence organized by case: /cases/CASEID/[raw/processed/reports]

SIFT Workstation Setup

SIFT (SANS Investigative Forensic Toolkit) is the most complete prebuilt DFIR VM available. It installs as an Ubuntu VM with all core DFIR tools pre-configured.

Bashsift-install.sh

# SIFT Workstation installation on Ubuntu 22.04
# Source: https://github.com/teamdfir/sift-cli

# Install SIFT CLI
curl -Lo /usr/local/bin/sift https://github.com/teamdfir/sift-cli/releases/latest/download/sift-cli-linux
chmod +x /usr/local/bin/sift

# Install SIFT (this installs all DFIR tools — takes 30-60 minutes)
sudo sift install

# Key tools installed by SIFT:
#   volatility3, plaso, log2timeline.py, timesketch
#   sleuthkit (fls, icat, mmls, fsstat, blkls)
#   bulk_extractor, foremost, scalpel (file carving)
#   afflib-tools (AFF format support)
#   ewf-tools (E01/Expert Witness Format)
#   libpff-tools (Outlook PST/OST analysis)
#   libesedb-tools (ESE database — SRUM, Windows Search)

# Verify key tools
volatility3 --version
log2timeline.py --version
fls --version 2>&1 | head -1

REMnux for Malware Analysis

Bashremnux-install.sh

# REMnux installation — malware analysis distribution
# Best deployed as an isolated VM with no real internet access
# (use inetsim to simulate network responses for malware detonation)

curl -o /tmp/remnux-cli https://REMnux.org/remnux-cli
mv /tmp/remnux-cli /usr/local/bin/remnux
chmod +x /usr/local/bin/remnux
sudo remnux install

# After installation, configure inetsim for network simulation:
sudo nano /etc/inetsim/inetsim.conf
# → Set: start_service http, https, dns, smtp, pop3, ftp
# → Set: dns_default_ip (your REMnux VM's IP — malware DNS resolves here)

# Start inetsim before detonating malware
sudo inetsim --log /tmp/inetsim.log &

# Key tools in REMnux:
#   floss          — extract obfuscated strings from binaries
#   capa           — identify capabilities in executables
#   yara           — scan samples against YARA rules
#   ghidra         — NSA disassembler/decompiler (separate install)
#   pestudio       — PE file analysis
#   oledump        — analyze Office macro documents
#   peframe        — quick PE static analysis
#   viperdb        — local malware sample management

Eric Zimmermann Tools (EZ Tools)

Eric Zimmermann's tools are the gold standard for parsing Windows forensic artifacts. They run on Windows and produce clean CSV output that can be fed directly into timeline analysis tools.

Tool	Artifact it parses	Key output
MFTECmd	$MFT (Master File Table)	Every file on the NTFS volume with timestamps, size, attributes
PECmd	Prefetch files	Executable run times, referenced DLLs, run count
AppCompatCacheParser	Shimcache (AppCompatCache)	Program execution evidence with last modified timestamp
AmcacheParser	Amcache.hve	SHA-1 hash + first execution timestamp for executables
LECmd	LNK files (shortcuts)	Target path, timestamps, volume serial number, MAC address
JLECmd	Jump Lists	Recently opened files per application, with timestamps
SBECmd	Shellbags	Directories the user browsed via Explorer, with timestamps
RECmd	Registry hives	Full registry parsing with hive exploration and batch queries
EvtxECmd	Windows Event Log (.evtx)	All events from all logs in CSV format with field extraction
SrumECmd	SRUM (System Resource Usage Monitor) database	Network usage and application execution by user, by day

Batchez-parse-all.bat

:: Parse all key artifacts from a KAPE triage collection
:: Assumes EZ Tools are in C:\Tools\EZTools\
:: Assumes KAPE output is in D:\cases\CASE001\triage\

set TOOLS=C:\Tools\EZTools\net6
set TRIAGE=D:\cases\CASE001\triage
set OUT=D:\cases\CASE001\parsed

:: MFT
%TOOLS%\MFTECmd.exe -f "%TRIAGE%\C\$MFT" --csv "%OUT%\mft" --csvf mft.csv

:: Prefetch
%TOOLS%\PECmd.exe -d "%TRIAGE%\C\Windows\Prefetch" --csv "%OUT%\prefetch"

:: Shimcache (from SYSTEM hive)
%TOOLS%\AppCompatCacheParser.exe -f "%TRIAGE%\C\Windows\System32\config\SYSTEM" --csv "%OUT%\shimcache"

:: Amcache
%TOOLS%\AmcacheParser.exe -f "%TRIAGE%\C\Windows\AppCompat\Programs\Amcache.hve" --csv "%OUT%\amcache" -i on

:: LNK files (all users)
%TOOLS%\LECmd.exe -d "%TRIAGE%\C\Users" --csv "%OUT%\lnk" -q

:: Jump Lists (all users)
%TOOLS%\JLECmd.exe -d "%TRIAGE%\C\Users" --csv "%OUT%\jumplists" -q

:: Shellbags (USRCLASS.DAT for each user)
%TOOLS%\SBECmd.exe -d "%TRIAGE%\C\Users" --csv "%OUT%\shellbags"

:: Event Logs
%TOOLS%\EvtxECmd.exe -d "%TRIAGE%\C\Windows\System32\winevt\Logs" --csv "%OUT%\evtx" --csvf evtx.csv

echo Parsing complete. Output in %OUT%

Case Organization

A consistent case directory structure lets you re-enter an investigation after days away and know exactly where everything is.

  Recommended Case Directory Structure
  ═══════════════════════════════════════════════════════════════════

  /cases/
  └── CASE-2026-001-FINANCE-SERVER/
      ├── 00_admin/
      │   ├── case-notes.md              ← Timestamped investigation log
      │   ├── chain-of-custody.csv       ← Evidence tracking
      │   └── timeline-summary.md        ← Human-readable incident timeline
      ├── 01_raw/
      │   ├── HOST-FINANCE-SRV01-RAM.raw ← Memory image (do not modify)
      │   ├── HOST-FINANCE-SRV01-DISK.E01← Disk image (do not modify)
      │   └── HOST-FINANCE-SRV01.sha256  ← Hash verification file
      ├── 02_triage/
      │   └── kape-output/               ← KAPE collected artifacts
      ├── 03_parsed/
      │   ├── mft/                       ← MFTECmd output
      │   ├── evtx/                      ← EvtxECmd output
      │   ├── prefetch/                  ← PECmd output
      │   └── memory/                    ← Volatility plugin output
      ├── 04_timeline/
      │   ├── case.plaso                 ← Plaso processed storage
      │   └── super_timeline.csv         ← Combined timeline
      ├── 05_malware/
      │   ├── samples/                   ← Extracted malware (password: infected)
      │   └── analysis/                  ← Static/dynamic analysis notes
      └── 06_reports/
          ├── findings-draft.md
          └── findings-final.pdf

Why isolated VMs are non-negotiable for malware analysis

When you analyze a live malware sample — run it in a debugger, extract it from a memory image and execute it, or open a malicious Office document — that malware may attempt to beacon, exfiltrate, or propagate. If your analysis environment is connected to your corporate network, you've just introduced live malware into production. REMnux with inetsim creates a simulated network: DNS queries resolve to the REMnux host, HTTP requests get dummy responses, and the malware believes it's connected to the internet — allowing you to observe its C2 behavior without any actual outbound connectivity. This isn't optional for safe malware analysis; it's the minimum viable isolation.

Q & A

Q: Should you analyze directly from a mounted disk image or copy artifacts out first?

Copy artifacts out for targeted analysis; mount the image for exploratory browsing. When you know you need to run PECmd against Prefetch, run it against the mounted image path and write output to your parsed/ directory — the source image is never modified (it's mounted read-only) and you've extracted the data you need. When you're exploring and not sure what you're looking for, Arsenal Image Mounter (Windows) or losetup + mount (Linux) lets you browse the filesystem of the image interactively, which is faster than running tool after tool guessing at artifact locations. The image itself stays pristine — all analysis output goes to your case directories, never back to the image mount point.