Evidence Handling and Forensic Analysis
Preserving integrity from the first touch
Forensic soundness rests on integrity and chain of custody. Candidates must understand order of volatility (RFC 3227): capture CPU/cache and memory, then network state, then disk, then backups/archives - most volatile first. Every acquisition should be hashed (e.g., SHA-256) at capture and re-verified later to prove no alteration.
Concepts to master
- Chain of custody: who handled evidence, when, where, and why - documented continuously.
- Write blockers and forensic images: never analyze the original; work on verified copies.
- Volatile vs. non-volatile data: RAM, running processes, network connections vs. disk, logs at rest.
- Live vs. dead-box forensics: live acquisition captures volatile data but alters the system; document the trade-off.
- Artifacts: file system timestamps (MACE), registry, event logs, browser history, prefetch, memory strings.
- Legal admissibility: authenticity, reliability, and completeness; maintain documentation.
Traps in questions
A classic trap is booting or shutting down a suspect machine, which destroys volatile evidence and alters timestamps. Another is analyzing the original disk instead of a verified image. Watch for questions that confuse hashing for integrity with encryption for confidentiality - hashing proves nothing changed; it does not hide data. Also, a hash match proves integrity, not authenticity of origin.
Rule of thumb
Most volatile first, hash everything, document every handoff. If you cannot prove the evidence was untouched, its value collapses.