Digital Forensics and Evidence Handling
Digital Forensics and Evidence Handling
This domain tests whether your evidence survives scrutiny: lawful acquisition, integrity proof, documented custody, and analysis that distinguishes what an artefact proves from what it merely suggests. Expect questions on acquisition order and on specific Windows artefacts.
Principles and order of volatility
The widely used ACPO principles require that no action changes data that may later be relied on in court; that if a person must access original data they are competent and can explain their actions; that an audit trail of all actions exists; and that the case officer is responsible for ensuring these principles are followed. RFC 3227 order of volatility runs: processor cache and registers, memory, network state, running processes, temporary file systems, disk, remote logs, archived media. Collect the most volatile first.
Acquisition and integrity
Photograph and label the device, record serial numbers, use a write blocker for storage, image rather than work on the original, and hash before and after acquisition with SHA-256 (MD5 may be recorded for legacy comparison). Preserve the original hash report. Document every transfer with who, what, when, where and why - that is the chain of custody. Memory capture needs a tool appropriate to the platform and a note that it changes memory state.
Artefacts and timeline
- NTFS: $MFT for file metadata, $UsnJrnl for change records, $LogFile for transactions. Remember MACB timestamps and that timestomping exists.
- Execution evidence: Prefetch, Amcache, ShimCache, SRUM for application resource usage.
- User activity: registry hives (NTUSER.DAT, SYSTEM, SOFTWARE), shellbags, jump lists, browser history.
- Logs: Security event log, PowerShell logs, Sysmon, and remote log aggregation. Build a timeline from multiple sources rather than a single artefact, and normalise to UTC while recording the system time zone.
Worked example: a seized laptop. You photograph and label it, record the serial, remove and write-block the disk, image it, hash the image and compare to the source hash, then analyse the verified copy. Prefetch and Amcache show execution of a tool never installed by the user; $MFT and $UsnJrnl place its creation minutes after a malicious email was opened per the browser history. Each step is logged with time and handler identity.
Traps: booting the suspect operating system; analysing the original media; hashing only after changes; omitting custody entries; misreading MACB timestamps or ignoring time-zone offsets.