CF-L3 / CCFT cheat sheet

Locard's exchange principle holds that every contact leaves a trace; digital actions may create, alter, or destroy artifacts.

Order of volatility: CPU registers and cache, RAM, network state, temporary files, disk storage, then backups and archives.

ACPO Principle 1: no action should change data that may later be relied upon in court.

Acquisition integrity is demonstrated by computing cryptographic hashes before and after imaging and comparing the values.

Chain of custody records who handled each item, when, where, why, and how, including every transfer and storage location.

Daubert factors include testability, peer review, known error rate, published standards, and general acceptance in the field.

Timeline analysis normalizes timestamps to a common time zone, usually UTC, and compares MACB times across sources.

Confirmation bias is countered by hypothesis testing, alternative explanations, and independent peer review.

Fourth Amendment bases for digital searches include a warrant, valid consent, exigent circumstances, plain view, and search incident to arrest.

Carpenter v. United States held that cell-site location information generally requires a warrant absent a recognized exception.

The Stored Communications Act governs compelled disclosure of stored communications held by providers.

The Wiretap Act covers interception of communication contents; the Pen Register Act covers dialing and addressing metadata.

Federal Rule of Evidence 803(6) is the business records exception to hearsay and often applies to routine computer logs.

The best evidence rule requires an original writing unless an exception applies; digital copies must be authenticated.

Ethical duties include impartiality, staying within engagement scope, disclosing conflicts, and avoiding ex parte contact.

Evidence categories include testimonial, documentary, physical, and digital; evidence may also be direct or circumstantial.

Volatile data collection order: network connections, running processes, RAM, then persistent storage.

File type verification compares the file signature or magic number with the extension; tools include file and TrID.

Email analysis reads Received headers bottom-up and checks SPF, DKIM, and DMARC authentication results.

Windows sources include $MFT, $UsnJrnl, $LogFile, Volume Shadow Copies, and registry hives.

Browser sources include History, Cookies, Cache, Local Storage, IndexedDB, and Downloads databases.

Cloud sources include Microsoft 365 Unified Audit Log, Azure AD sign-in logs, Google Workspace audit logs, and AWS CloudTrail.

Mobile evidence levels are manual, logical, file-system, and physical extraction, with SQLite app databases commonly examined.

A write blocker is hardware or software that permits read-only access and must be verified before imaging.

Image formats include raw/dd, E01, Ex01, and AFF4; E01 supports compression, case metadata, and verification.

MD5 is legacy; SHA-1 is deprecated for security; SHA-256 is the preferred integrity hash.

Live acquisition captures RAM and network state but alters the system, so every action must be documented.

RAM acquisition tools include FTK Imager, DumpIt, WinPmem, and LiME.

Mobile isolation uses a Faraday bag or airplane mode; powering off may prevent access if encryption keys are needed.

Chain of custody fields include item ID, date and time, handler, hash value, storage location, and purpose of transfer.

Legal authority and scope are confirmed before acquisition; collection is limited to the authorized scope.

NTFS Master File Table records default to 1024 bytes, and resident attributes are stored within the MFT record.

NTFS $STANDARD_INFORMATION and $FILE_NAME timestamps can differ; manipulation of one set suggests timestomping.

FAT directory entries are 32 bytes; deleting a file typically replaces the first byte with 0xE5, and 8.3 names are used.

ext4 uses inodes, a journal, a superblock, and extent trees to describe file data blocks.

MBR supports four primary partitions and a 2 TB limit; GPT supports 128 entries and includes a backup header.

Slack space is the unused remainder of the last cluster; unallocated space may contain deleted file content.

File carving recovers data using headers, footers, and structural patterns rather than file system metadata.

APFS uses copy-on-write, snapshots, and containers with volumes that share free space.

Windows registry hives include SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.DAT, and UsrClass.dat.

Windows execution artifacts include Prefetch, Amcache, ShimCache, UserAssist, SRUM, and BAM.

Windows Security events include 4624 successful logon, 4625 failed logon, 4688 process creation, and 7045 service installation.

USB device history appears in USBSTOR, setupapi.dev.log, and MountedDevices.

Linux logs include /var/log/auth.log, syslog, wtmp, btmp, bash_history, and cron files.

macOS artifacts include unified logs, FSEvents, quarantine events, and launchd property lists.

Browser SQLite databases include History, Cookies, Downloads, and Web Data.

Windows file deletion artifacts include $Recycle.Bin and its $I and $R files.

PCAP analysis uses tcpdump and Wireshark, with BPF filter syntax to isolate traffic.

TCP connection setup is SYN, SYN-ACK, ACK; TCP flags indicate connection state and scanning behavior.

Common ports include 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, and 3389 RDP.

Log sources include firewall, IDS/IPS, DNS, proxy, VPN, DHCP, authentication, and NetFlow records.

DNS tunneling indicators include long high-entropy subdomains, TXT or NULL queries, and high query volume to one domain.

Log times are normalized to UTC, and NTP synchronization is verified to avoid event misordering.

Log integrity is supported by hashing exports, preserving originals, and documenting the collection method.

SIEM correlation joins on IP address, user, and time, while accounting for retention gaps.

Mobile extraction types are manual, logical, file-system, and physical, in increasing order of depth.

iOS artifacts include keychain items, SMS/MMS, call history, Safari data, location data, and app property lists.

Android acquisition may use ADB backup, root access, or physical imaging; /data/data holds app data.

Cloud logs include Microsoft 365 Unified Audit Log, Azure AD sign-in logs, Google Workspace audit logs, and AWS CloudTrail.

Cloud data location, provider terms, and jurisdiction affect the legal process used to obtain evidence.

Emerging sources include IoT devices, vehicle infotainment and telematics, drones, and wearable devices.

Container forensics examines image layers, the writable layer, and volumes; capture may use docker export or save.

Cloud chain of custody includes API export method, hash values, metadata, and collection timestamps.

Report sections typically include executive summary, scope and authority, methodology, findings, conclusions, limitations, and appendices.

Daubert requires qualification, reliability, and fit; Frye requires general acceptance in the relevant field.

Lay witnesses give opinions based on perception; expert witnesses may give specialized opinions based on reliable methods.

Documentation includes contemporaneous notes, tool versions, hash values, exhibit identifiers, and storage locations.

Peer review before release checks reproducibility, accuracy, and consistency between findings and conclusions.

Testimony rules include answering only the question asked, explaining technical terms, and avoiding advocacy.

Reports disclose limitations, uncertainty, contrary findings, and any assumptions made during analysis.