CFCE cheat sheet

Forensic readiness is the pre-incident capability to collect, preserve, and use evidence; measured across people, process, technology, and law, not just tooling.

Readiness maturity ladder: (1) ad hoc collection, (2) documented procedures, (3) trained staff and tested tools, (4) continuous logging with validated retention, (5) audited and measured readiness program.

Evidence source inventory categories: endpoint (disk, RAM, logs), network (flow, PCAP, DHCP, DNS), identity (AD, IdP, VPN), cloud/SaaS audit logs, physical access control, and CCTV.

Log retention rule of thumb: retention window >= (mean time to detect + mean time to respond + legal hold horizon); shorter windows create permanent evidence gaps.

Volatile data order (RFC 3227): registers/cache, routing table/ARP/process memory, RAM, swap, network state, running processes, disk, remote logs, backups, archival media.

Time synchronization: all sources should use NTP against a common reference; record clock offset so timestamps can be normalized during analysis.

Readiness testing: tabletop exercises plus live collection drills; a control is only ready if a collection was actually performed and verified end to end.

Legal readiness: pre-approved consent banners, acceptable-use policy, and preservation letter templates reduce delay when litigation or law enforcement involvement is likely.

Four privacy elements (Sedona/EDRM): (1) lawful basis and authority, (2) reasonable expectation of privacy, (3) consent, (4) proportionality of collection scope.

Jurisdiction conflict rule: when data crosses borders, the stricter law controls unless a formal mutual legal assistance or data-transfer mechanism applies.

Chain of authority: written authorization (warrant, subpoena, consent, corporate policy) must exist before collection; document who authorized, scope, and time.

Best-evidence/original-document doctrine: originals preferred; copies admissible only when authenticated and shown to be accurate reproductions.

Hearsay exception for computer records commonly relies on business-records foundation: created in regular course, at or near the time, by someone with knowledge.

Ethical duties: competence, confidentiality, objectivity, avoidance of conflicts of interest, and disclosure of limitations or errors in findings.

Privilege: attorney-client and work-product protections can be waived by careless handling; route privileged material to counsel and log exclusion decisions.

Licensing: examiner certifications and tool licenses are not legal authority; state the authority basis separately from technical qualification.

Order of volatility governs collection sequence; collect volatile data before powering down, and document every action taken.

Write blockers: hardware or software blockers must prevent writes to the source; verify blocker function with a test write before each acquisition.

Faraday isolation: mobile devices should be isolated in a Faraday bag or airplane mode to prevent remote wipe, but note that isolation changes radio state and must be logged.

Handling rule: minimize handling, use anti-static packaging, label with unique exhibit ID, and record seal state at every transfer.

Photograph the scene and device state (screen, connections, ports) before disconnecting or altering the device.

Degaussing destroys magnetic media and is not appropriate for evidence; use it only for sanitization of non-evidence media.

Hash at acquisition, then re-hash at analysis and at return; any mismatch requires documented investigation before proceeding.

Spoliation prevention: never boot a suspect drive from its native OS; use a forensic boot environment or write-blocked attachment.

Chain-of-custody record fields: exhibit ID, description, source, collector, date/time, location, purpose, hash value, and each transfer with signatures.

Custody gap rule: any unaccounted period between documented transfers weakens authentication; gaps must be explained in the report.

Documentation set: collection notes, photographs, acquisition logs, hash records, tool versions, analysis notes, and final report.

Contemporaneous notes: record actions at the time they occur; later reconstruction is admissible only with explanation of why notes were not contemporaneous.

Exhibit numbering: unique, stable identifiers that survive transfer; avoid reusing IDs across cases.

Hash records must include algorithm (SHA-256 preferred, MD5 legacy), value, file or device scope, and tool/version used to compute it.

Documentation must record deviations from procedure and their rationale; undocumented deviation is the most common credibility attack.

Storage log: record environmental conditions (temperature, humidity, access) for long-term evidence storage.

HDD geometry: platters, heads, tracks, sectors (512 or 4096 bytes), cylinders; logical block addressing (LBA) replaced CHS addressing.

SSD behavior: wear leveling, TRIM, and garbage collection move or erase data independent of the OS; TRIM can destroy deleted-file evidence after deletion.

NAND structure: pages (typically 4-16 KB) are the write unit, blocks (hundreds of pages) the erase unit; FTL maps logical to physical pages.

SMR vs CMR drives: shingled drives have slow random writes and may remap sectors internally, complicating imaging.

RAID: reconstruction requires knowing level, stripe size, and disk order; parity for RAID 5/6 can rebuild a missing member for imaging.

Encryption: full-disk (BitLocker, LUKS, FileVault) and self-encrypting drives (Opal) require keys or recovery data; imaging encrypted media yields ciphertext only.

Bad sectors: acquisition tools should log unreadable sectors and continue; a partial image is still evidence if documented.

Media sanitization standards (NIST SP 800-88): clear, purge, destroy; destroy is required for classified media and for confirmed sanitization.

NTFS core: $MFT records file metadata, $LogFile is a transaction journal, $UsnJrnl records changes, $Bitmap tracks cluster allocation.

NTFS timestamps: $STANDARD_INFORMATION (SI) and $FILE_NAME (FN) each hold four timestamps; discrepancies indicate timestomping or normal system updates.

FAT: directory entries hold name, attributes, first cluster, and size; deleted entry has first byte set to 0xE5; FAT copies and slack are recoverable sources.

ext3/ext4: superblock, inode table, block/inode bitmaps, journal (jbd2); ext4 uses extents instead of indirect block pointers.

APFS: copy-on-write with snapshots; container holds volumes sharing free space; snapshots preserve prior states useful for recovery.

HFS+/APFS catalog and extents overflow files hold file metadata; resource forks and extended attributes may hold evidence.

Slack space: file slack (end of last cluster) and volume slack (unallocated clusters after the last allocated cluster) can hold residual data.

Journaling replay: journal may contain prior versions of metadata; parse with a tool that understands the specific journal format rather than raw carving.

Image formats: raw/dd (no metadata), Expert Witness Format (E01, with compression and per-block hashes), AFF4 (open, compression, sparse), and logical/container exports.

Hash verification: compute acquisition hash, then verification hash from the image; matching SHA-256 values establish integrity of the image copy.

E01 stores an internal MD5 per block; a mismatch in a block indicates corruption of that block, not necessarily of the whole image.

Sparse imaging: skip known-zero blocks to reduce size; document the sparse map so the image can be reconstructed exactly.

Logical acquisition captures files and folders, not deleted space; it is faster and smaller but loses unallocated evidence.

Physical acquisition captures every addressable sector, including unallocated and slack space; preferred when deleted-data recovery matters.

Imaging over network: use a validated write-blocked acquisition agent; record source path, destination, block size, and errors.

Verification failure handling: re-image or document the failure, do not silently proceed; the discrepancy must appear in the report.

Registry hives: SYSTEM (services, timezone, computer name), SOFTWARE (installed apps, run keys), SAM (local accounts), SECURITY (audit policy), NTUSER.DAT (per-user).

Amcache.hve and ShimCache record program execution and file presence; Prefetch (.pf) records execution count and last-run times for launched programs.

LNK files and Jump Lists record recently accessed files and volumes; Shellbags record folder navigation and window positions.

Event logs: Security (logon 4624, logoff 4634, process creation 4688), System, Application, and PowerShell operational logs.

$UsnJrnl:$J records file create/delete/rename with USN and timestamp; $LogFile records metadata transactions for NTFS recovery.

Recycle Bin: $I files hold original path and deletion time; $R files hold content; per-SID subfolders map to user accounts.

Browser artifacts: History, Cookies, Cache, and session files under user profiles; timestamps in Chrome use WebKit epoch (microseconds since 1601).

SRUM (System Resource Usage Monitor) records per-app network and resource usage, useful for activity timelines even without application logs.

Deletion mechanics differ: FAT clears directory entry; NTFS marks MFT record unallocated; ext clears inode link count; recovery depends on whether clusters were reused.

File carving uses headers and footers (magic numbers) to find file content in unallocated space without metadata; it recovers content, not names or paths.

Carving limits: fragmented files, compressed or encrypted content, and overwritten clusters defeat simple signature carving.

Carving tools: foremost, scalpel, bulk_extractor (feature extraction), and PhotoRec; validate output by opening recovered files and checking integrity.

Recovery priority: metadata-based recovery (MFT, inode, FAT entry) preserves names and timestamps; carving is a fallback when metadata is gone.

Unallocated space analysis: extract unallocated clusters, then run carving and string searches; document the source range for each recovered item.

Timeline correlation: recovered file content alone may lack timestamps; correlate with journal, USN, or MFT records to establish time.

Evidence integrity: recovered files should be hashed and stored separately; never write to the original evidence image.

PCAP analysis: filter by IP, port, protocol; reconstruct TCP streams; note that capture start time bounds the evidence window.

Network artifacts: DHCP leases (IP-to-MAC mapping), DNS query logs, ARP tables, NetFlow, firewall and proxy logs, and VPN session logs.

Email headers: Received chain (bottom-up), Message-ID, Return-Path, DKIM-Signature, SPF results; forged headers often break the Received chain.

Email storage: PST/OST (Outlook), MBOX and Maildir (Unix); OST is a local cache and may not reflect server state.

Web evidence: browser cache, cookies, history, and local storage; server-side logs corroborate client-side artifacts.

Cloud and SaaS logs: audit logs (e.g., sign-in, file access) are often the only record; retention is controlled by the provider.

Encrypted traffic: TLS metadata (SNI, certificate, timing) remains visible even when content is encrypted; document the limits of inference.

Time normalization: network devices may log in UTC or local time; record device timezone and offset before correlating with host artifacts.

Mobile acquisition levels: manual (screen-by-screen), logical (backup/agent), file system, and physical (full flash image); each yields different evidence depth.

iOS: encrypted iTunes/Finder backups contain keychain and app data when a backup password is set; full file-system extraction requires a jailbreak or supported exploit.

Android: ADB backup, logical extraction via vendor tools, and physical extraction via root or supported bootloader methods; app sandboxes limit access.

SIM/USIM: ICCID, IMSI, SMS store, and last-dialed numbers; SMS may persist on SIM after deletion from the handset.

GPS and vehicle infotainment: track logs, paired-device lists, and navigation history; infotainment units store phone contacts and call logs.

IoT and wearables: fitness, health, and home-automation data can establish presence and activity timelines; cloud sync often holds more than the device.

Drone and camera media: EXIF (camera model, GPS, timestamps), and flight logs for drones; verify whether GPS data is device-generated or post-edited.

Isolation and power: prevent remote wipe and network sync; record battery state and whether the device was powered on at seizure.

Report structure: scope and authority, methodology, tools and versions, findings with evidence references, limitations, and conclusion.

Opinion vs fact: label observations as facts and conclusions as expert opinion; state the basis for each opinion.

Peer review: independent technical review of method and findings before report issuance; document reviewer, date, and issues raised.

Daubert factors: testability, error rate, peer review and publication, general acceptance, and standards controlling the technique.

Lay vs expert testimony: lay witnesses testify to observations; expert witnesses may offer opinions within their qualified scope.

Testimony preparation: rehearse direct examination, anticipate cross-examination on chain of custody, tool error, and alternative explanations.

Report language: avoid absolute claims ("proves", "definitely"); use calibrated language ("consistent with", "indicates").

Discovery obligations: retain notes, tool output, and working files; opposing counsel may request them.

Tool categories: acquisition (dd, FTK Imager, Guymager), analysis (Autopsy, EnCase, X-Ways, Magnet AXIOM), carving (foremost, PhotoRec), memory (Volatility, Rekall).

Command-line imaging: dd with block size and error handling; dc3dd and dcfldd add hashing and progress reporting.

Volatility workflow: identify profile, list processes, dump memory, extract network connections; record plugin version and profile used.

Registry parsing: RegRipper, Registry Explorer, and yarp; record hive source path and parser version.

Timeline tools: log2timeline/Plaso and Timesketch; validate by spot-checking source events against raw artifacts.

Tool output is not evidence: the underlying artifact is; cite the artifact and show the tool output as interpretation.

Licensing and cost: open-source tools are acceptable when validated; commercial tools are not inherently more reliable.

Automation risk: scripted analysis must be reproducible; record script version, inputs, and outputs.

Validation is the process of confirming a tool produces correct results for a defined function; verification is confirming a specific result.

NIST CFTT program publishes test reports for imaging, write blockers, and mobile tools; cite reports relevant to the specific function tested.

Known-answer testing: use test images with known content and hashes; record pass/fail and tool version.

Write-blocker validation: attempt a write to a test device through the blocker and confirm the write fails and the hash is unchanged.

Tool version control: every report must state tool name, version, and configuration; upgrades invalidate prior validation for that function.

Error rate documentation: record false positives and false negatives observed during validation and during casework.

Proficiency testing: external schemes (e.g., CTS) provide independent assessment; retain certificates and results.

Quality management: ISO/IEC 17025 or 17020 accreditation covers competence, method validation, and traceability of measurements.

Validation is the process of confirming a tool produces correct results for a defined function; verification is confirming a specific result.

NIST CFTT program publishes test reports for imaging, write blockers, and mobile tools; cite reports relevant to the specific function tested.

Known-answer testing: use test images with known content and hashes; record pass/fail and tool version.

Write-blocker validation: attempt a write to a test device through the blocker and confirm the write fails and the hash is unchanged.

Tool version control: every report must state tool name, version, and configuration; upgrades invalidate prior validation for that function.

Error rate documentation: record false positives and false negatives observed during validation and during casework.

Proficiency testing: external schemes (e.g., CTS) provide independent assessment; retain certificates and results.

Quality management: ISO/IEC 17025 or 17020 accreditation covers competence, method validation, and traceability of measurements.