CCFR key terms

A chronological record tracking who handled evidence, when, where, and why, from seizure through analysis to final disposition. Gaps or undocumented transfers can render digital evidence inadmissible or undermine its weight in proceedings.

A bit-for-bit duplicate of a storage device or volume, including slack and unallocated space, created with a write-blocker so the source remains unaltered. Investigators analyze the copy while the original stays preserved.

A fixed-length cryptographic digest (for example SHA-256) computed over data to detect any change. Matching hashes before and after acquisition or analysis demonstrate that evidence has not been altered.

A hardware or software control that permits read-only access to storage media, preventing the operating system or tooling from writing to evidence. It protects the source device during acquisition and preview.

The assurance that collected digital evidence is authentic, complete, and unmodified since acquisition. It is demonstrated through hashing, documented procedures, controlled access, and consistent chain-of-custody records.

Information lost when a system powers off, such as running processes, network connections, RAM contents, and logged-in sessions. It is typically captured first because it cannot be recovered later.

A prioritized sequence for collecting evidence from most to least perishable, starting with CPU registers and memory, then network state, disk, and finally archival media. Following it preserves data that would otherwise disappear.

Analysis of a captured RAM image to recover running processes, injected code, network connections, encryption keys, and artifacts absent from disk. It is central to detecting fileless malware and advanced intrusions.

Any trace left by system or user activity that supports reconstruction of events, such as registry keys, prefetch files, log entries, shellbags, or browser history. Investigators correlate artifacts to establish what happened and when.

Correlating timestamped events from multiple sources into a single chronological view to reconstruct an incident. Normalizing time zones and understanding file system timestamp behavior are essential to avoid misleading conclusions.

The four standard file system times: Modified, Accessed, Changed (metadata), and Born (created). Their behavior differs by file system, and interpreting them correctly is necessary for accurate event reconstruction.

Recovering files from unallocated space or damaged media by locating known file headers and footers rather than relying on file system metadata. It can retrieve deleted content but may produce false positives.

Disk clusters not currently assigned to any file, which may still contain remnants of deleted or overwritten data. It is a primary target for carving and for recovering prior versions of evidence.

Deliberate techniques used to obstruct investigation, such as timestomping, secure deletion, log wiping, encryption, or steganography. Detecting these manipulations is itself valuable evidence of intent.

Altering file timestamps to make content appear older or newer than it is, often to blend malicious files into system directories. Inconsistencies among MACB values or with other logs can reveal the manipulation.

Collecting evidence from a running system, capturing volatile state and active configuration before shutdown. It preserves data lost on power-off but must be performed with documented, minimally intrusive commands.

A verified copy of evidence produced under controlled conditions, often used for analysis while the original is archived. Verification typically relies on comparing cryptographic hashes of source and copy.

A documented set of roles, procedures, and communication paths guiding an organization's response to security incidents. It defines escalation, authority, and coordination so decisions are made before pressure peaks.

The phases an incident passes through, commonly preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Each phase has distinct objectives and deliverables that structure the response.

A detailed, repeatable procedure for handling a specific incident type, such as ransomware or business email compromise. It specifies concrete steps, tooling, and decision criteria so responders act consistently under pressure.

An operational guide describing how to execute particular technical tasks or systems during response, often at a lower level than a playbook. It reduces error by standardizing commands, checks, and expected outputs.

Actions taken to limit the spread and impact of an incident, such as isolating hosts, blocking traffic, or disabling accounts. Short-term containment stops damage while long-term measures enable recovery.

Removing the root cause of an incident, including malware, persistence mechanisms, compromised credentials, and vulnerable configurations. It follows containment and precedes recovery to prevent immediate reinfection.

Restoring affected systems and services to normal operation under verified, trustworthy conditions. It includes validation testing, monitoring for recurrence, and staged return to production.

A structured post-incident review identifying what worked, what failed, and what should change in process, tooling, or training. Findings are tracked to closure so the organization improves before the next event.

Rapidly assessing alerts or incidents to determine severity, scope, and required urgency, separating genuine threats from noise. Effective triage directs limited responder effort to the highest-impact events first.

Assigning a defined level to an incident based on business impact, data sensitivity, and spread, which drives escalation and resource allocation. Consistent criteria prevent subjective, inconsistent responses.

The process of raising an incident to higher authority or additional teams when it exceeds defined thresholds or responder capability. Clear escalation paths ensure timely decisions and executive awareness.

Observable evidence suggesting a system has been breached, such as malicious file hashes, domains, IP addresses, or registry keys. Indicators support detection but can be brittle when attackers rotate infrastructure.

Evidence of adversary behavior or intent during an intrusion, such as unusual process chains, lateral movement patterns, or persistence techniques. Behavior-based indicators are more durable than static compromise artifacts.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by goal. Responders use it to map detected behavior, prioritize coverage, and describe findings consistently.

Proactively searching environments for undetected adversary activity using hypotheses and behavioral analytics rather than waiting for alerts. Findings feed detection improvements and inform incident response priorities.

Separating a compromised host or network segment from others to stop lateral movement and command-and-control traffic. It may be achieved through network controls, endpoint tools, or physical disconnection.

A formal request asking a party, such as a cloud provider or employer, to retain relevant data that may be needed for investigation or litigation. It helps prevent routine deletion or retention expiry.

Predefined channels, audiences, and message templates for notifying stakeholders during an incident, including legal, executive, and customer contacts. It prevents rumor, duplication, and inconsistent disclosure.

A discussion-based simulation where participants walk through a realistic scenario to test plans, roles, and decisions without touching production systems. It exposes gaps cheaply before a real incident.

Contextual information about adversaries, campaigns, and infrastructure used to inform detection and response decisions. It ranges from tactical indicators to strategic reporting on actor intent and capability.

A systematic method for identifying the underlying conditions that allowed an incident, beyond the immediate trigger. It distinguishes technical, process, and human factors so remediation addresses recurrence.

The policy and configuration determining how long system, network, and security logs are kept and protected from tampering. Inadequate retention frequently destroys the evidence needed for investigation.