Analysis and Reporting improvements with Notebooks

Free and open source scientific notebook software allows responders to performanalysis and record results simultaneously in an open, flexible, portable format for ease of sharing and reporting. Fully worked samples can improve analyst and responder mentoring and education. Use of notebook templates can encourage good practices, uphold standards, and improve investigative rigor for better DFIR science and better incident response. Suggested configuration options and server platform notes for SIFT3 explain notebook setup for forensics. The proposed workflow and methodology show how DFIR process and techniques are integrated into notebooks and the SIFT server environment and a walk through a sample investigation with notebooks illustrates the advantages.