Digital Forensics
Digital Forensics tests disciplined evidence handling from seizure to courtroom-ready reporting. C|CT items ask what to preserve first, how to prove integrity, and which artifact answers a question without altering the original.
Core rules
- Follow the order of volatility: collect CPU registers, cache, and RAM before disk, then remote logs, backups, and archival media, adapting to the incident.
- Preserve the original. Use write blockers for storage, photograph and document connections, and work from verified copies.
- Maintain chain of custody: who collected, when, where, why, and every transfer or access.
- Hash evidence at acquisition and verify the copy; record algorithms such as SHA-256. A hash supports integrity, not guilt.
- Acquire memory with a validated tool and record the tool version, command, and output hash.
- Build a timeline from file system metadata, logs, registry artifacts, browser history, and application records. Corroborate before concluding.
Worked example
A Windows workstation is suspected of USB data exfiltration. The machine is still running. The analyst should first capture volatile memory and relevant live state, then power down only according to policy, image the disk with a write blocker, and verify the image hash. On the copy, examine USBSTOR registry entries for device identifiers and first and last connection times, setupapi logs, shellbags, link files, and event logs around the suspected window. Reasoning: RAM may hold mounted volumes, credentials, or process artifacts that vanish on shutdown; the disk image preserves USB history. The finding is a correlation of device, user, time, and file access, not a single registry key.
Traps
Booting or shutting down a suspect system can destroy volatile evidence. Working directly on the original changes metadata. Hashing only the original without verifying the working copy breaks the integrity argument. A file's modified timestamp is not proof of when it was created or exfiltrated. Do not confuse backup images with forensic images; backups may omit slack space, deleted data, or metadata. Also avoid claiming that deleted files are always recoverable.