Disk Image or Live Response?
A workstation is suspected of being the staging host for data exfiltration. The user is a senior executive who is traveling and will return in 36 hours; the laptop is currently powered on and connected to the corporate network. Legal has placed a litigation hold on the matter because the executive is involved in a pending lawsuit unrelated to the incident. The forensic team has one examiner available, a 4-hour window before the executive's assistant wants the laptop for a presentation, and a policy that requires chain-of-custody documentation for any collected evidence. The EDR agent on the host has already uploaded a process tree and network connections to the console.
1. Should the team perform a live response, a full disk image, or rely on the EDR telemetry? Justify the choice.
Read the worked answer
This is a live-response-first, image-second situation, with EDR telemetry as corroboration rather than a substitute.
- Relying on EDR alone is insufficient. The console has process and network data, but not file contents, deleted artifacts, browser history, or the staging directory itself. For an exfiltration case, the actual staged data and transfer artifacts matter.
- A full disk image is desirable but not the first move on a powered-on host. Powering down or imaging first loses volatile evidence (memory, live connections, running processes, encryption keys in RAM) that may be the only link to the exfil destination. Live response should capture volatile data first: memory, running processes, network connections, logged-on users, and the staging directory contents.
- The 36-hour and 4-hour constraints are real but should not override evidence integrity. The assistant's presentation is a business convenience, not a legal requirement; the litigation hold and chain-of-custody policy take precedence. The examiner should document the request and escalate to legal/HR rather than hand over the laptop.
- Sequence: live volatile capture → logical collection of relevant artifacts (staging folder, browser, logs) → then a full disk image if the host can be taken offline, or a documented decision to defer imaging with the executive's return.
Key judgement: volatile data is perishable; disk data is not. Capture what disappears first, and do not let a convenience deadline compromise a litigation-held device.
2. What chain-of-custody and legal considerations must the examiner address, and how do they affect the technical plan?
Read the worked answer
- Litigation hold changes the scope. The device is subject to a hold for an unrelated lawsuit, so any collection must preserve potentially relevant material and not alter or destroy it. The examiner should collect broadly enough to satisfy the hold, not just the incident artifacts, and coordinate with legal counsel on scope.
- Chain of custody must be documented from the first touch: who collected, when, where, what tool and version, hash values (SHA-256) of any image or logical collection, storage location, and every transfer. Without this, the evidence may be challenged.
- Use write-blockers for any disk imaging and document hash before/after to demonstrate integrity. For live response, document that volatile collection is inherently non-repeatable and record the tooling and timestamps.
- Minimize disruption to the executive's data but do not let that minimize the collection. If the laptop must be returned, image or logically collect first and document what was returned and when.
- Privilege and privacy: the executive may assert privilege over some files; legal should advise. The examiner collects, legal decides on review.
The technical plan therefore shifts from 'grab the staging folder' to 'collect volatile data, then a defensible image or logical collection with hashes and custody records, coordinated with legal.'
3. The assistant insists the laptop be returned in 4 hours. How should the examiner respond?
Read the worked answer
The examiner should not hand over the device while it is evidence under a litigation hold without authorization. Response:
- Escalate to legal and the incident commander immediately - the decision to release a held device is a legal decision, not a forensic one.
- Offer a compliant alternative: complete the volatile and logical collection within the window, image if feasible, and return the device only with documented legal approval and a record of what was collected and what remains.
- Document the request and the response in the case file, including timestamps, so the pressure and the decision are auditable.
- Explain the risk plainly: returning or altering the device before collection could be construed as spoliation under the hold, exposing the organization to sanctions.
The judgement: business convenience does not override a litigation hold; the examiner's job is to preserve options and escalate, not to make the legal call or to quietly comply.