> For the complete documentation index, see [llms.txt](https://book.jorianwoltjer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.jorianwoltjer.com/forensics.md).

# Forensics

- [Wireshark](https://book.jorianwoltjer.com/forensics/wireshark.md): A popular tool to analyze and extract data from network packet captures
- [File Formats](https://book.jorianwoltjer.com/forensics/file-formats.md): What to do with a file you don't understand
- [Archives](https://book.jorianwoltjer.com/forensics/archives.md): Different kinds of file archives, like ZIP, RAR or TAR
- [Memory Dumps (Volatility)](https://book.jorianwoltjer.com/forensics/memory-dumps-volatility.md): Big dump of the RAM on a system. Use tools like volatility to analyze the dumps and get information about what happened
- [VBA Macros](https://book.jorianwoltjer.com/forensics/vba-macros.md): Visual Basic for Applications is a programming language used to create macro scripts for Microsoft office apps
- [Grep](https://book.jorianwoltjer.com/forensics/grep.md): Search for text inside of files
- [Git](https://book.jorianwoltjer.com/forensics/git.md): A version control system often saving lots of information about how files were changes
- [File Recovery](https://book.jorianwoltjer.com/forensics/file-recovery.md): Recovering content of deleted files