CCFR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

RFC 3227 ranking of evidence by how quickly it disappears: registers and cache first, then RAM and network state, then disk, then backups and archival media.

Chain of custody

Chronological documentation of who handled evidence, when, where, and why. Any unexplained gap weakens authenticity and can render the evidence inadmissible in legal proceedings.

Forensic image verification

Hash the source device before acquisition and hash the resulting image afterward. Matching MD5 or SHA-256 values demonstrate the copy is bit-for-bit faithful to the original.

Write blocker

Hardware or software control that permits read-only access to a storage device so the acquisition process cannot alter the source media or its timestamps.

Slack space

Unused remainder of the last allocated cluster of a file. It can retain fragments of previously deleted files and is a common target for data-recovery examination.

$MFT

NTFS Master File Table. It holds one record per file and directory with attributes, timestamps, and cluster runlists; deleted records remain marked unallocated until reused.

$UsnJrnl

NTFS change journal recording file creations, deletions, renames, and modifications with sequence numbers. Useful for reconstructing file activity even after the file is deleted.

Prefetch files

Windows .pf files under Prefetch that record executables run, load counts, and referenced files and volumes. They provide evidence of program execution and approximate run times.

Amcache.hve

Windows registry hive storing metadata about executed or installed applications, including file paths and SHA-1 hashes. Helpful for identifying binaries that ran on a host.

ShimCache

AppCompatCache registry artifact listing executables the system considered for execution. Presence indicates the file existed on the system; it does not by itself prove execution.

UserAssist

Registry key under NTUSER.DAT recording GUI program launches with run counts and last-execution times, stored ROT13-encoded. Strong indicator of interactive user execution.

MACB timestamps

Modified, Accessed, Changed (MFT metadata), and Born (creation) times. Interpretation depends on filesystem granularity, timezone, and whether tools or the OS updated them.

File carving

Recovering files from unallocated space by recognizing header and footer signatures rather than filesystem metadata. Works when directory entries are gone but content survives.

Live response trade-off

Collecting from a running system captures volatile data but alters state. Record every command executed so later analysis can distinguish investigator changes from attacker activity.

Browser forensics artifacts

History, downloads, cache, cookies, and session files stored in SQLite databases. They establish user web activity, timing, and possible malware delivery or data exfiltration.

Windows event log analysis

Security log covers logons and privilege use; System log covers service and driver changes; PowerShell logs capture script blocks. Event IDs anchor timeline reconstruction.

NIST IR life cycle

Four phases from SP 800-61: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity. Each phase has defined outputs feeding the next.

Incident severity triage

Assess functional impact, information impact such as confidentiality or integrity loss, and recoverability effort. These three factors determine escalation level and response resources.

Containment strategy selection

Choose isolation, segmentation, or continued monitoring based on evidence-preservation needs, business impact, and attacker awareness. Document the rationale and the criteria for lifting containment.

Evidence-preserving containment

Block malicious traffic at firewall, proxy, or switch port instead of powering off the host. This stops spread while keeping memory and volatile state available for acquisition.

Eradication completeness

Remove the root cause and every persistence mechanism: scheduled tasks, services, autoruns, added accounts, WMI subscriptions, and web shells. Missing one allows re-entry.

Recovery validation

Rebuild from known-good images, confirm no command-and-control beaconing in egress logs, verify patched entry points, and monitor the restored systems before declaring the incident closed.

MTTD and MTTR

Mean time to detect and mean time to respond. Track dwell time from initial intrusion to detection separately, since it measures detection capability rather than response speed.

Incident commander role

Single decision authority coordinating technical, legal, communications, and business stakeholders. Clear ownership prevents conflicting containment actions and duplicate investigations.

Breach notification triggers

Predetermined legal and contractual criteria, such as exposure of regulated personal data, that start notification clocks. Legal counsel confirms scope and deadlines during the incident.

Lessons learned review

Post-incident meeting held soon after closure producing corrective actions with named owners and due dates. Findings feed back into the Preparation phase to improve future response.

Jump bag contents

Pre-staged response kit: forensic laptops, write blockers, blank media, hashing tools, network taps, cables, labels, chain-of-custody forms, and contact lists. Verified and refreshed periodically.

Playbook vs runbook

A playbook defines the strategy and decision points for an incident class; a runbook gives step-by-step commands for a specific scenario. Both are exercised during preparation.

Tabletop exercise

Discussion-based simulation of a scenario with key stakeholders. It tests decision-making, communication paths, and role clarity without touching production systems.

Indicators of compromise

Observable artifacts such as malicious hashes, domains, IPs, registry keys, or filenames. They support detection but age quickly, so behavior-based rules complement them.

Eradication vs recovery

Eradication removes the attacker's foothold and cause; recovery restores normal operations. Recovery before eradication is complete typically results in reinfection.

Incident documentation timeline

Contemporaneous log of actions, times, decisions, and evidence handling. It supports legal proceedings, regulatory reporting, and the post-incident review with verifiable detail.