Evidence Handling
Evidence Handling
This domain tests identification, collection, and preservation. The exam expects an order-of-volatility approach, minimal interaction with original media, and documentation that another examiner could follow.
Collection rules
- Secure and photograph the scene before touching devices; record device state, connections, lights, and screen contents.
- Follow RFC 3227 volatility order: registers and cache, RAM, network connections and configuration, running processes, temporary files, disk, logs, and archival media.
- For a running computer, consider live response first. Do not shut down if encryption keys or volatile evidence would be lost; document every command.
- For a powered-off computer, do not boot it. Remove and label power sources, package media in anti-static material, and protect from heat, shock, and magnetic fields.
- For mobile devices, use a Faraday bag when appropriate; avoid powering on; preserve battery and passcode state; document any airplane-mode change.
Preservation and integrity
Use a hardware or software write blocker, hash before and after acquisition, and keep originals sealed. Working copies are for analysis. Record serial numbers, model, capacity, and condition.
Worked example
A running laptop has BitLocker enabled and a logged-in session. The examiner captures RAM first because it may contain the volume encryption key, then images the disk. Shutting down first could lose the key and make the disk unreadable without a recovery key. The decision and rationale are recorded contemporaneously.
Traps
Shutting down every running machine by default; booting a suspect disk; putting a mobile device in airplane mode without documenting the state change; failing to seize power supplies; handling media without anti-static protection.
Key points
- Collect volatile data before persistent data.
- Do not boot suspect media; use write blockers.
- Documentation must permit independent repetition.
- Mobile devices require power and lock-state preservation.
- Hash originals and analyze working copies.