Digital Forensics: Order of Volatility and Evidence Integrity
Preserve first, analyze second
Forensics questions hinge on order of volatility: collect CPU registers and cache, then RAM, then network state and running processes, then temporary files and disk, then remote logs and archives. Capture RAM before pulling the plug, because memory holds encryption keys, network connections, and injected code that vanish on shutdown.
Artifacts by platform
On Windows, know the difference between registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT), event logs (Security, System, Application, PowerShell), $MFT for file metadata, $UsnJrnl for change journal records, Prefetch for execution evidence, Amcache/ShimCache for program presence, and LNK/jump lists for user activity. On Linux, cover /var/log, auth.log, bash history, and process memory. On the network side, cover PCAP, NetFlow, and proxy logs.
Integrity and traps
Maintain chain of custody, hash evidence at acquisition (SHA-256), work on write-blocked copies, and document every action with timestamps and timezone. Traps: confusing $MFT (metadata) with $UsnJrnl (change records); claiming Prefetch proves a user launched a program (it proves execution, not intent); ignoring timestamp interpretation (UTC versus local, MACB meanings); and forgetting that anti-forensics like timestomping can make timestamps inconsistent with $MFT entries.
Worked example: a host is suspected of malware execution. Acquire RAM, then image the disk with a write blocker and hash it. Parse Prefetch and Amcache for the binary, check $UsnJrnl for creation and deletion, and correlate Security event 4688 (process creation) with 4624 (logon) to tie activity to an account. Rule of thumb: if you cannot show how evidence was preserved and hashed, your finding is challengeable regardless of how convincing it looks.