Forensics Fundamentals - Evidence Integrity, Volatility, and Legal Framing
Domain 1 - Forensics Fundamentals
This section tests how you preserve and acquire digital evidence before anyone analyzes it: chain of custody, order of volatility, legal constraints, and which Cisco capture points feed an investigation. Marks here come from procedure, not from tool trivia.
Integrity is the product
- Image through a hardware write blocker; never analyze the original media.
- Hash at acquisition and re-hash after imaging (SHA-256 preferred); record both values, the tool and version, the examiner, and a UTC timestamp.
- Chain of custody is a running log - who held the item, when, why, and where it was stored. A single undocumented gap can make evidence challengeable.
- Work from verified copies and keep the original sealed.
Order of volatility (RFC 3227)
Capture most-perishable first: CPU registers and cache → RAM and swap → network state (ARP cache, netstat, routing table, DNS cache) → running processes and open handles → temp files and in-memory logs → disk → remote logs, backups, and archival media. Powering a machine off destroys RAM-resident evidence and any live encryption keys; pulling the network cable preserves more than shutdown does and still stops the attack.
Legal and regulatory framing
Confirm written authorization and scope before touching a system, then apply data minimization and jurisdiction rules. GDPR Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a personal-data breach, so documentation speed is itself a compliance control.
Where Cisco tools yield evidence
Secure Endpoint supplies process trajectory, file disposition, and host isolation; Umbrella supplies DNS and proxy logs; Firepower/FTD supplies connection and intrusion events; routers and switches supply NetFlow/IPFIX; ASA supplies syslog; ISE supplies authentication and posture records.
Worked example
A workstation is beaconing to an unknown IP. Correct sequence: (1) capture live RAM through the endpoint agent and export the process list and netstat output in UTC; (2) preserve the EDR event stream; (3) remove the host from the network without shutting it down; (4) image the disk with a write blocker and hash it; (5) pull matching NetFlow and DNS records. Reasoning: each step takes the more volatile source before the less volatile one, and none of them modifies the original media.
Traps
Shutting the machine down "to be safe"; saving notes onto the suspect disk; reporting in local time; treating a single file modification time as proof of execution; forgetting to re-hash after transfer.