Practical Digital Forensics

About SUSA

SUSA brings together Windows forensic tools and practical guides for using them. This page covers the project, its connection to Cyber Defence Kit, and the terms for reusing the documentation.

Explore the project Contact SUSA

Windowsforensics workstation CCBY-NC 4.0 documentation DFIRpractical guides

01

Project

Windows tools and hands on guides for digital forensics and incident response.

Security Utility Suite for Analysts Tools for the investigation, guides for the analyst

SUSA stands for Security Utility Suite for Analysts. The name also comes from the Korean word 수사 (susa), meaning “investigation.” The guides cover workstation setup, evidence collection, artefact analysis, memory and network investigation, timelines, and reporting.

SUSA is a sister project to Cyber Defence Kit (CDK), maintained by Joseph Jee. SUSA focuses on Windows forensic tools and investigation workflows. The projects share a practical approach: explain the tools, show the steps, and make the results easier to check.

Using the guides Screenshots show the versions used when each guide was written. Check the options in your installed version and test the steps on known data before using them in a case.

02

Responsible use

Work within the agreed scope, protect the original evidence and keep notes that another analyst can follow.

1

ScopeDefine the question

Record what you are authorised to examine and what you need to find out.

2

PreserveProtect original material

Use working copies, separate destinations and isolated virtual machines where appropriate.

3

ExplainExplain what you found

Keep the output with your tool version, settings and notes. Distinguish what the evidence shows from what you infer.

Use an authorised environmentTreat recovered files, links, archives, memory images and suspicious samples as potentially sensitive or unsafe.

03

Ownership

SUSA is maintained by Joseph Jee. Third party tools and material retain their own terms.

The copyright notice applies to original SUSA material credited to Joseph Jee. It does not claim ownership of the tools, screenshots or other material credited to third parties.

Development record The repository records changes to the documentation. Check its licence and any notice on the page before reusing material.

04

Documentation licence

You can share and adapt the original documentation for non commercial use under CC BY-NC 4.0, unless a page states otherwise.

Creative Commons licence Attribution-NonCommercial 4.0 International

You may share and adapt covered material for non commercial purposes when all licence conditions are followed.

Read the CC BY-NC 4.0 licence

1

AttributionGive appropriate credit

Identify the source and creator of the covered material.

2

Licence noticeLink to the licence

Make the applicable Creative Commons terms available to the audience.

3

TransparencyIdentify your changes

State clearly whether the original material was modified.

Other usesContact the project for uses outside the licence, including commercial use, unless an applicable exception or limitation permits the use.

05

Project identity

The documentation licence does not cover every name, image or product shown in the guides.

Licence boundarySUSA project identity The SUSA name, logo and other project identity elements are not included in the documentation licence. Restriction They may not be used to imply ownership, affiliation or endorsement without prior written permission.

Third party rightsRights remain with their owners Product names, trade marks, logos, screenshots, quoted text and other identified third party material remain the property of their respective owners. Page specific terms Where a page identifies different terms for particular material, those terms take precedence for that material.

06

Contact

Questions, corrections and reuse enquiries are welcome.

Project contact Security Utility Suite for Analysts

Email the project if you spot an error, have a question about a guide, or want to discuss reusing SUSA material.

Helpful details For a correction, include the page, tool version and what you observed. For reuse, describe the material and how you plan to use it.

Email the SUSA project