Incident response and forensics
The first day with an image
The disk or the memory image is already in the case folder. You do not work on the original. By the end of the day you can say one sentence about what the timeline shows.
Do not work on the original
The file you were given stays untouched. Copy it, and open the copy. If a tool has to read something, it reads the copy. The original is what you hash again later to prove you still have the same bytes.
The case folder is that habit written down: original, working copy, hash, and the time you received it. Notes sit beside the folder, not inside it.
The hash
Write the hash you were given, or the hash you computed on the original when it arrived, and which algorithm it is. Compare it before you trust the copy. A mismatch means you stop. You do not “fix” the file.
The hash is a name for the bytes. It does not say what is on the disk or in memory. It only says this is still the file you were handed.
The timeline
A disk and a memory image use different clocks. Write both times and label them. Do not average them into one story. The timeline lab is five events you put in order after the zones are named.
The forensics workbench is Autopsy for what was saved on a disk, and Volatility for what was still in memory. Pick the one that matches the file in the folder. A memory image is not a disk, and a disk is not a substitute for the processes that were running.
One sentence by the end of the day
Say what the timeline shows, who or what it names, and what you did not open. “The copy matches the hash, and the first event in the lab timeline is the logon at this time” is a sentence. “I looked at the image” is not.
If the case is a ransom note, the first hour is still about recording and calling, not about clearing the machine. The finding is that sentence. The DFIR path on the careers page is the longer list of lessons. Finish the sentence before you open the rest of the list.