I85PREP
⌘ K
CFCI study materials
CFCI study resources

CFCI: Digital Forensics: Defensible Acquisition, Artifact Analysis, and Reporting

CFCI · Work through your exam, one topic at a time.

All guide sections

Digital Forensics: Defensible Acquisition, Artifact Analysis, and Reporting

The Digital Forensics domain tests defensible acquisition, examination, and reporting. The exam cares less about tool menus than about whether your process survives a challenge: did you preserve the original, prove integrity, document every hand, and tie each conclusion to a specific artifact?

Acquisition principles

  • ACPO principles: no action should change data; where change is unavoidable, use a competent person, record what was done, and explain the effect; maintain an audit trail; the case officer retains overall responsibility.
  • Order of volatility: cache and CPU, RAM, network state, temporary files, disk, backups, archival media.
  • Write blocker and bit-stream image, then hash both source and image (SHA-256) and compare values.
  • Chain of custody: item number, description, collector, date and time, location, transfers, and storage conditions.

Artifacts worth knowing

  • NTFS: $MFT for timestamps, $UsnJrnl for change records, $LogFile for metadata transactions.
  • Windows: USBSTOR registry keys, LNK files, Jump Lists, Prefetch, Event ID 4624/4625 for logon success and failure, 4688 for process creation, $Recycle.Bin, Event ID 1102 for a cleared log.
  • Email: full headers, PST/OST containers, server message tracking.
  • Mobile and cloud: device backups, app databases, provider logs obtained by legal process.
  • Anti-forensics: timestomping, secure wiping, encrypted containers, deliberate log clearing.

Worked example

A departing employee is suspected of copying a client list. Photograph the screen, capture RAM because a sync client is running, then image the disk through a write blocker and verify the hash. In the image, $MFT shows a spreadsheet created at 02:14; USBSTOR shows a Kingston device first connected at 02:10; an LNK file points to the removable drive; cloud logs show an upload at 02:20. Three independent artifacts support one timeline, which is far stronger than any single file, and the report states each artifact and its source separately.

Traps that cost marks

  • Booting the original before imaging, then hashing it.
  • Assuming deleted files are unrecoverable.
  • Performing a live acquisition without documenting what changed.
  • Overstating a conclusion drawn from one artifact instead of corroborating it.
  • Confusing the hash of the original with the hash of the working copy.