I85PREP
⌘ K
CNCDP study materials
CNCDP study resources

CNCDP: Digital Forensics and Evidence Handling

CNCDP · Work through your exam, one topic at a time.

All guide sections

Digital Forensics and Evidence Handling

Digital Forensics and Evidence Handling

This domain tests whether your collection and analysis would survive scrutiny in a hearing. Items ask what to capture first, how to prove integrity, and which artifact answers a question such as "was this file executed?"

Core rules and concepts

  • Order of volatility (RFC 3227): CPU registers and cache → memory → network state (ARP cache, connections, routing) → running processes → disk → remote logs and monitoring data → backups and archival media. Capture the most perishable evidence first.
  • Chain of custody: who collected, when, where, from which device and serial number, by what method, hash values, storage location, and every transfer with signatures. Any gap invites a challenge to admissibility.
  • Acquisition discipline: use a hardware or software write blocker for dead-box imaging, image to a forensic format (E01 or raw with a companion hash), compute SHA-256 at acquisition and re-verify at analysis, and work only on copies. Live acquisition is justified when the system is encrypted, running active malware, or is a cloud instance that cannot be powered down.
  • Legal standards: Daubert governs expert reliability in US federal courts; FRE 902(14) allows self-authentication of digital copies supported by a hash. Authorization and privacy law constrain what you may collect from employee devices.
  • Windows artifacts: $MFT and $UsnJrnl (file creation and change), Prefetch (execution), Amcache and ShimCache (program presence and execution traces), SRUM (network and resource usage), event logs, registry hives (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT), LNK files and jump lists (user activity), Volume Shadow Copies for historical states.
  • Linux artifacts: /var/log/auth.log or secure, auditd logs, systemd journal, shell history, /etc/passwd and shadow, cron entries, and process memory via /proc or LiME.
  • Memory analysis: Volatility 3 plugins such as windows.pslist, windows.netscan and windows.malfind reveal hidden processes, live connections and injected code that disk analysis misses.
  • Analysis: build a normalized UTC timeline, correlate artifacts across sources, and look for anti-forensics (timestomping, log clearing, secure deletion).

Worked example

A suspected insider-exfiltration laptop is seized while powered on with full-disk encryption. Order of action: photograph and document the scene, capture memory first, record network connections and logged-on users, then image the disk through a write blocker while the volume is mounted, hash both images, log every step, and analyze only the copies. Reasoning: powering down would lose the decryption keys and volatile evidence; imaging without hashing would break integrity.

Traps that cost marks

  • Booting or shutting down the suspect machine.
  • Analyzing the original evidence instead of a verified copy.
  • A chain-of-custody form with missing transfer signatures.
  • Forgetting timezone normalization across sources.