CCFH cheat sheet

Daubert factors for admissibility: testability, peer review and publication, known error rate, standards and controls, general acceptance; the judge acts as gatekeeper under FRE 702.

Frye standard (federal pre-2013 practice and some states): a technique must be generally accepted in the relevant scientific community; it is narrower than Daubert and does not weigh error rates.

Locard's exchange principle: every contact leaves a trace; it justifies searching for transfer evidence but does not guarantee that a recoverable trace exists.

Chain-of-custody and authentication are governed by FRE 901(a): proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be.

Best-evidence rule (FRE 1002) requires the original writing, recording, or photograph to prove content; FRE 1003 allows duplicates unless authenticity is disputed, and FRE 1006 permits summaries of voluminous records.

Forensic soundness rests on four properties: repeatability, reproducibility, traceability of method, and documented uncertainty; absence of any one weakens the opinion.

Expert testimony may embrace an ultimate issue (FRE 704) but may not state legal conclusions such as whether a defendant is guilty.

Digital evidence is generally treated as a 'writing' for hearsay purposes; computer-generated records (no human declarant) are not hearsay, while computer-stored records are and need an exception.

Chain of custody records, at minimum: who handled the item, what was done, when, where, and why; gaps create authentication challenges under FRE 901.

Order of volatility (RFC 3227): CPU registers and cache, RAM and swap, network state, running processes, disk, remote logs, archival media, printed output.

Write blockers prevent host writes to storage; hardware blockers intercept at the bus, software blockers filter at the OS driver, and neither protects against device-internal writes such as wear leveling.

Faraday isolation prevents remote wipe and network sync but blocks Wi-Fi/Bluetooth-based acquisition and can drain battery; document the choice and its effect on time.

Evidence packaging must be antistatic for drives and paper (not plastic) for wet biological items; each container gets a unique exhibit number, seal, and initials across the seal.

A hash value proves integrity of the acquired image relative to the source at acquisition time; it does not prove the source was unaltered before seizure.

Photograph the scene before collection, including device screens showing date/time, and record serial numbers, IMEI/MEID, and any visible damage.

Volatile memory should be captured before power-down when the device is on; pulling the plug preserves RAM only if hibernation/pagefile capture is planned, otherwise an orderly shutdown overwrites artifacts.

Bit-stream (physical) image copies every addressable sector including slack and unallocated space; logical image copies only files and file system metadata.

Hash algorithms in common use: MD5 (128-bit), SHA-1 (160-bit), SHA-256 (256-bit); record source hash, image hash, and the verification comparison result.

A sparse or intelligent image stores only non-zero/non-duplicate sectors; it is smaller but must be documented because it is not a full bit-stream copy.

dd-style acquisition with a write blocker and a known-pattern wipe of the destination drive is the reference method; verify with at least two independent hash algorithms.

Live acquisition alters the system; document every command and its effect, and prefer tools that log to external media to minimize footprint.

A 'known good' hash set (e.g., NSRL) filters OS files but cannot prove a file is non-contraband; hash matches identify known files only.

Image formats: raw/dd (no metadata), E01/EWF (compressed, chunked, with case metadata and CRC per chunk), AFF4 (open, compressed, supports sparse and multiple hash streams).

Disk-to-disk cloning must account for larger destination geometry; sector-by-sector clone preserves the file system only if the destination is at least as large and geometry is compatible.

NTFS: MFT record (1024 bytes typical) holds $STANDARD_INFORMATION and $FILE_NAME timestamps; $FILE_NAME timestamps are not updated by ordinary user-mode writes, so they can reveal tampering.

NTFS $LogFile ($LogFile) and $UsnJrnl ($J) record metadata changes; $UsnJrnl:$J can recover file creation/deletion history when MFT entries are gone.

FAT: directory entry holds 32 bytes with creation, access, and write timestamps; FAT has no journaling, so deleted-entry recovery depends on whether the cluster was reused.

ext3/ext4: inode holds atime, mtime, ctime, and crtime (birth); ctime is inode-change time and cannot be set by user tools, so it exposes timestamp manipulation.

Deletion behavior: FAT clears the first character of the name and frees clusters; NTFS sets the in-use flag in the MFT record; ext clears the inode link count and zeroes pointers.

Unallocated space holds deleted file content; slack space is the tail of the last cluster beyond logical EOF and can retain prior file fragments.

File carving recovers content by header/footer signatures without file system metadata; it cannot reliably recover names, timestamps, or fragmented files.

Hashing and signature analysis of file headers (magic numbers) detects extension mismatch, e.g., a .jpg whose header is a ZIP (PK\x03\x04) or an executable (MZ).

Windows registry hives: SYSTEM (services, USBSTOR, time zone), SOFTWARE (installed apps, run keys), SAM (local accounts), SECURITY (audit policy), NTUSER.DAT (per-user MRU, typed paths, shellbags).

Shimcache (AppCompatCache) records executed-file paths and, on Windows 10+, last-modified time; Amcache records program installation/execution metadata with SHA-1.

Prefetch files (.pf) exist only if enabled; they record run count, last run times, and referenced files/volumes, and are capped at 1024 entries by default on Windows 10.

$MFT $STANDARD_INFORMATION vs $FILE_NAME timestamp pairs: a 0x10 (SI) time earlier than the 0x30 (FN) time for the same event suggests timestomping.

Windows event logs: Security 4624 logon (types 2 interactive, 3 network, 10 RDP), 4625 failure, 4688 process creation (requires audit policy), 1102 log cleared.

Linux artifacts: /var/log/auth.log or /var/log/secure, wtmp/btmp/lastlog, ~/.bash_history, /etc/passwd and /etc/shadow, cron tables, and systemd journal.

macOS artifacts: unified logs (log show), .DS_Store (folder view metadata), quarantine events (com.apple.quarantine xattr), FSEvents, and KnowledgeC.db.

Browser artifacts: History (SQLite), Cookies, Cache, and session restore files; Chrome/Edge 'Login Data' stores encrypted credentials tied to OS-level keys.

PCAP analysis: follow TCP streams to reconstruct application data; Wireshark display filters like ip.addr==, tcp.port==, http.request.method== isolate traffic.

NetFlow/IPFIX records flow metadata (5-tuple, bytes, packets, start/end) but not payload; use it for scope and timeline, not content.

Syslog severity levels 0 (emergency) to 7 (debug); facility and severity are encoded in the PRI field as facility*8+severity.

DHCP logs map IP to MAC to hostname for a lease window; NAT/PAT logs map internal IP:port to external IP:port for a session, and both are needed to attribute an external IP.

DNS logs show queried names and response codes; NXDOMAIN spikes and high-entropy subdomains suggest DGA or DNS tunneling.

Firewall/proxy logs record allow/deny decisions and URLs; a missing log entry is not proof of no activity - logging may be disabled or the flow may bypass the sensor.

Clock skew and time zone normalization must be handled before correlating logs; convert all sources to UTC and record the offset applied.

Log integrity: centralized remote logging (syslog-ng, SIEM) reduces tampering risk; local logs can be altered by an attacker with root/SYSTEM.

Mobile acquisition levels: manual (screen capture), logical (backup/API), file system (jailbreak/root or agent), and physical (chip-off or advanced extraction); each yields different artifact depth.

iOS backups: iTunes/Finder backups are encrypted if a password is set; unencrypted backups omit Keychain and some health/location data.

Android: ADB backup (deprecated on newer versions), root-based dd, and vendor/forensic-agent extractions; SQLite databases (contacts, SMS, call log) are the primary artifacts.

Cloud evidence is held by a third party; preservation relies on legal process (subpoena, MLAT, GDPR-compliant disclosure) and provider retention windows, not on examiner control.

Cloud artifacts on endpoints: browser sync data, OAuth tokens, installed-app tokens, and cached files; SaaS audit logs (e.g., sign-in, file access) are the authoritative record.

Containers: a container image is layered; deleted files may persist in lower layers, and the writable layer holds runtime changes. Kubernetes audit logs and etcd are key sources.

IoT/embedded: firmware extraction via UART/JTAG, SPI flash dumps, and vendor update files; NAND wear leveling complicates chip-off recovery.

Vehicle/telematics and drone forensics rely on proprietary formats and manufacturer tools; document tool version and any conversion applied.

IR lifecycle: preparation, identification, containment, eradication, recovery, lessons learned; containment must preserve evidence before remediation.

Static analysis: file type via magic bytes, strings, PE/ELF headers, imports, sections, entropy (packed/encrypted sections often >7.0 bits/byte), and embedded hashes.

Dynamic analysis: sandbox detonation with network simulation; monitor process tree, file/registry writes, and network callbacks.

Persistence mechanisms: Run keys, scheduled tasks, services, WMI subscriptions, cron/systemd units, LaunchAgents/Daemons, and browser extensions.

MITRE ATT&CK maps observed behavior to tactics/techniques; use it to structure findings, not as a substitute for evidence.

Memory forensics: identify injected code (malfind), process anomalies (pslist vs psscan), and network connections (netscan); hibernation and pagefile extend memory artifacts.

Indicators of compromise include hashes, domains, IPs, mutexes, registry keys, and file paths; IOCs are perishable and must be dated.

Volatile evidence collection order follows RFC 3227; capture memory before rebooting, and document the tool and its hash.

Report structure: scope and authority, items examined, methods and tools with versions, findings with supporting artifacts, limitations, and conclusions.

Every factual assertion should be traceable to an exhibit, artifact path, or hash; include the tool version and the steps needed to reproduce the result.

Distinguish observation from interpretation: 'the file was created at 14:02 UTC' is observation; 'the user created it' is inference requiring support.

State limitations explicitly: incomplete images, missing logs, tool error rates, and the effect of examiner actions on the system.

Opinions must be within the examiner's expertise; qualify the basis and be prepared to explain methodology under cross-examination.

Avoid absolute claims ('this proves'); use calibrated language ('consistent with', 'indicates') and explain the strength of the inference.

Demonstrative exhibits (timelines, diagrams) must be derived from and consistent with the underlying data; retain the source and the derivation method.

Retention: keep case notes, images, and tool outputs for the period required by policy or court order; document any destruction.