Question

During enterprise-scale incident response, a forensic analyst has collected disk images from five compromised hosts. Investigators need to reconstruct the exact sequence of attacker actions across filesystem metadata, registry hives, event logs, and browser artifacts to determine the initial access vector. Which approach best supports this reconstruction?

Accepted Answer

Generate a super timeline by parsing artifacts from each image into normalized time-based events, then correlate across hosts using a common time reference

Answer

Run an antivirus scan against each mounted image and record the detection timestamps as the authoritative event sequence

Answer

Compare current file hashes against a known-good gold image and treat all mismatches as chronologically ordered attacker activity

Answer

Extract only the Windows Security event log from each host and rely on logon events to establish the full attack chain