I85PREP
⌘ K
CCFR study materials
CCFR study resources

CCFR: Cyber Forensics: Acquisition, Preservation, and Admissibility

CCFR · Work through your exam, one topic at a time.

All guide sections

Cyber Forensics: Acquisition, Preservation, and Admissibility

Cyber Forensics tests whether you can acquire, preserve, examine, and report digital evidence so it survives technical scrutiny and a courtroom. The exam favors process discipline: what you touch first, how you prove integrity, and how you document every transfer.

Core rules

  • Order of volatility (RFC 3227). Capture the most perishable first: CPU registers and cache, then RAM, process table, network connections, ARP cache, temporary file systems, then disk, then remote logs, then archival media.
  • NIST SP 800-86 phases. Collection, examination, analysis, reporting. ISO/IEC 27037 uses identification, collection, acquisition, preservation.
  • Integrity. Hash the source before and after acquisition (SHA-256 is standard), hash the image, and record both values. A matching hash does not prove the image is complete, only unchanged.
  • Write blocking. Use a hardware write blocker for disks; document model, firmware, and validation. Never mount evidence read-write.
  • Chain of custody. Record who handled the item, when (UTC), where, why, and what changed. Gaps invite suppression.
  • Admissibility. US federal courts apply Daubert and FRE 902(14) for self-authenticating electronic evidence with a hash; UK practice follows ACPO principles.

Worked example

A finance workstation is suspected of exfiltration. You photograph the screen, capture RAM with a validated tool, record netstat output and logged-on users, then remove the disk and image it through a write blocker. You hash the source disk and the image with SHA-256; values match. You then examine the $MFT, USN journal, Prefetch, and browser history, build a UTC timeline, and report tool versions and hash values. Reasoning: RAM holds encryption keys and live connections that disk cannot show; the write blocker and hashes prove you did not alter the source; UTC avoids daylight-saving ambiguity.

Traps

Powering off before RAM capture; using cp on a live system; hashing only the image; recording local time instead of UTC; skipping write-blocker validation; treating a backup as a forensic image; and failing to note tool versions or acquisition errors.