Incident Response and Digital Forensics
Domain 5 tests incident response phases and forensic handling. Use NIST SP 800-61 as the mental model: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Forensics adds order of volatility, chain of custody, and evidence integrity.
Core rules and concepts
- Preparation includes playbooks, contacts, tooling, and authority to isolate systems.
- Detection validates alerts; analysis scopes affected hosts, accounts, and data.
- Containment can be short-term (isolate) or long-term (rebuild). Eradication removes the cause; recovery restores trusted service.
- Preserve volatile evidence first: memory, network connections, running processes, then disk. Powering off can destroy memory-resident malware.
- Use write blockers and hash images (SHA-256) before and after acquisition. Document every transfer in a chain-of-custody form.
- Legal hold and privacy law may restrict what you collect and share.
Worked example
A laptop shows beaconing. Isolate it from the network, capture RAM with a validated tool, record running processes and network connections, then image the disk with a write blocker and hash it. Do not log in and delete files. Reasoning: isolation stops spread; memory may hold the implant and keys; hashing proves the image matches the source; documentation makes findings admissible.
Traps that cost marks
Rebooting or shutting down destroys volatile evidence. Eradicating malware before containment can tip off the attacker. A forensic image without a hash has weak integrity proof. Breaking chain of custody can invalidate evidence.