Start your way

What brings you to SUSA?

Prepare a Windows DFIR workstation, follow a practical investigation path, or go directly to the utility you need.

01 I am new to SUSALearn what the workstation provides and how the documentation is organised. About SUSA 02 I want to prepare a workstationBuild the Windows environment before installing and using the forensic tools. Start setup 03 I already know what I needBrowse evidence collection, artefact analysis, memory, network and timeline guides. Browse the toolkit

A practical investigation path

From workstation to supported findings

SUSA connects environment preparation, evidence acquisition, focused analysis and timeline reconstruction so each stage can build on the last.

❚❚ Pause animation

01Prepare 02Collect 03Analyse 04Correlate

Create a forensic workstation

Build a Windows VM, install WSL, improve forensic visibility and create shortcuts.

Prepare the environment

Recommended starting points

Choose a first practical guide

Filter these starting points by investigation goal, then open a practical SUSA guide with a defined evidence-focused outcome.

What do you want to practise?

Show all Collect evidence Analyse evidence Reconstruct activity

4 recommended guides

Evidence collectionPractical guide

KAPE

Collect and process targeted forensic artefacts from a Windows system.

Focus: targeted acquisition and processing.

Windows workstationGuided workflow

Open guide

Disk analysisPractical guide

Autopsy

Open and examine forensic data using an established disk-analysis workflow.

Focus: disk images and recovered evidence.

Windows workstationGuided workflow

Open guide

Memory analysisPractical guide

Volatility and Workbench

Investigate a memory image with Volatility and its Workbench interface.

Focus: processes and volatile evidence.

Memory imageGuided workflow

Open guide

Network forensicsPractical guide

Wireshark

Inspect packet captures, follow conversations and extract useful network evidence.

Focus: traffic analysis and reconstruction.

Packet captureGuided workflow

Open guide

Explore by evidence source

Explore the SUSA toolkit

Start with an investigation family, then open the evidence source or utility that matches your task.

01 · Acquire and preserve

Evidence Collection

Collect live system state, disk data and volatile memory before moving into analysis.

Open Evidence Collection

02 · Examine hosts and storage

Host & Storage Analysis

Recover files and interpret persistent Windows, NTFS, browser and Registry evidence.

Open Host & Storage

03 · Inspect activity

Volatile & Network Analysis

Review recorded events, running state and communications from complementary evidence sources.

Open Volatile & Network

04 · Reconstruct and assess

Threat & Timeline Analysis

Order activity, inspect suspicious files and connect email evidence with the wider case.

Open Threat & Timeline

05 · Support the workflow

Analyst Utilities

Inspect live Windows behaviour and complete common hashing, archive and working-data tasks.

Open Analyst Utilities

One practical workstation

Move through the forensic workflow

Use SUSA to prepare the environment, collect evidence, examine artefacts and reconstruct activity with documented, repeatable steps.

SETAvailable nowPrepareCreate and configure the Windows forensic workstation.

GETAvailable nowCollectAcquire live, disk and memory evidence for analysis.

SEEAvailable nowAnalyseExamine artefacts across systems, applications and memory.

TIMEAvailable nowCorrelateCombine evidence into an ordered reconstruction of activity.