CCFR cheat sheet

Order of volatility (RFC 3227): CPU registers and cache > RAM and network state > swap/temp files > disk > remote logs and backups > archival media; collect in that order.

Chain of custody record fields: item ID, description, serial/hash, collector, date/time, location, transfer history, storage conditions; a gap in the record can make evidence inadmissible.

Hash integrity: compute MD5/SHA-256 at acquisition and re-verify before analysis; document both values. A changed hash means the image is not a faithful copy.

Write blockers prevent host OS writes to the source device; a hardware blocker is preferred over software blocking for legal defensibility.

Deleted-file recovery depends on filesystem: NTFS MFT entry marked unallocated, data may persist in clusters until overwritten; FAT directory entry first byte set to 0xE5.

NTFS artifacts: $MFT (file records), $LogFile (metadata transactions), $UsnJrnl (change journal), $Secure (ACLs), $Bitmap (cluster allocation).

Windows execution artifacts: Amcache.hve (program execution/paths), ShimCache (AppCompatCache), Prefetch (.pf), SRUM, UserAssist; each has different reliability and retention.

Timeline correlation: normalize timestamps to UTC, note filesystem granularity (FAT 2s, NTFS 100ns) and timezone offsets in logs; MACB times alone do not prove user action.

Live response capture order: memory image, network connections (netstat), running processes, logged-on users, then disk; each command alters system state, so record what was run.

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.

Severity triage inputs: functional impact, information impact (confidentiality/integrity loss), and recoverability effort; these three drive escalation level.

Containment choice: isolation (network segment/power off) vs. monitoring. Powering off destroys volatile evidence; isolate the network first when malware analysis is needed.

Evidence-preserving containment: block at firewall/proxy or disable switch port rather than shutting down; keep memory intact for acquisition.

Eradication requires identifying root cause and all persistence (scheduled tasks, services, accounts, WMI subscriptions); removing only the payload leaves re-entry.

Recovery validation: confirm clean state via re-imaging from known-good baseline, verify no C2 beaconing in egress logs, and monitor for 30+ days post-recovery.

MTTD and MTTR are the core IR metrics; report dwell time (intrusion to detection) separately from response time.

Communication: predefined escalation contacts, legal/privacy notification triggers (e.g., breach-notification deadlines), and a single incident commander for decisions.

Lessons learned: hold within two weeks of closure, produce corrective actions with owners and due dates, and feed them back into Preparation.