Mile2 CDFE cheat sheet

Forensics process order: identification, preservation, acquisition, examination, analysis, reporting - skipping preservation invalidates later stages.

Chain of custody is an unbroken documented record of who handled evidence, when, where, and why; any gap weakens admissibility.

Order of volatility (RFC 3227): CPU registers/cache, RAM, swap, network state, running processes, disk, backups, archival media - collect most volatile first.

Locard's exchange principle: every contact leaves a trace; perpetrator and scene transfer material both ways.

Forensic soundness requires repeatability (another examiner reaches the same result) and reproducibility (same tool, same input, same output).

Write blockers prevent host writes to evidence media; hardware blockers are preferred over software because the OS cannot bypass them.

Hash algorithms for integrity: MD5 and SHA-1 are legacy; SHA-256 is the current default for evidence verification.

Live vs dead acquisition: live captures volatile data but alters the system; dead acquisition is cleaner but loses RAM-resident evidence.

Forensic copy types: physical (bit-for-bit whole device), logical (partition or volume), sparse (allocated data only).

Forensic readiness = pre-incident capability to collect, preserve, and use evidence; measured by data retention, logging depth, and response tooling.

Evidence labeling minimum: unique case ID, item number, description, source, collector name, date/time, and hash value.

Faraday isolation blocks radio (cellular, Wi-Fi, Bluetooth) to stop remote wipe of mobile devices.

Anti-static bags for electronics; paper bags for biological or wet evidence to prevent mold; never seal wet items in plastic.

Documentation must record the hash of the acquired image, the tool and version used, and the acquisition start/end timestamps.

Legal hold suspends routine deletion and rotation; verify backups and log retention are frozen before imaging.

Evidence spoliation is destruction or alteration of evidence; negligent handling can trigger adverse inference in court.

Acquisition log entries include: device serial, write-blocker model/serial, connection type, and any errors encountered.

Order of collection at a scene: secure the area, photograph, then collect most volatile to least volatile.

MBR partition table: 4 primary entries, 512-byte sectors, partition starts at sector 0x1BE; GPT uses 64-bit LBA and CRC32 headers.

NTFS key metadata: $MFT (file records), $LogFile (journal), $Bitmap (cluster allocation), $UsnJrnl (change journal), $Secure (ACLs).

NTFS timestamps: $STANDARD_INFORMATION vs $FILENAME - $SI is user-modifiable, $FN is updated by the file system; compare both for timestomping.

FAT: directory entries hold 8.3 names; deleted entries have first byte set to 0xE5; FAT32 root directory is a cluster chain, not a fixed area.

ext3/ext4: superblock at offset 1024 bytes, inode table, block group descriptors; ext4 uses extents and journal (jbd2).

Slack space = allocated cluster minus actual file size; can retain remnants of prior files.

Unallocated space holds deleted content not yet overwritten; carving (file-signature recovery) targets this region.

Deleted file recovery: NTFS clears the in-use flag in $MFT and frees clusters in $Bitmap; data persists until reuse.

Hashing a whole-disk image produces one value; hashing logical files verifies content but not partition structure.

PCAP analysis pivots: conversation statistics, protocol hierarchy, then display filters (e.g., http.request.method == "POST").

TCP three-way handshake SYN, SYN/ACK, ACK confirms connection; RST terminates; absence of handshake indicates spoofing or midstream capture.

NetFlow/IPFIX records flow metadata (5-tuple, bytes, timestamps) but not payload; PCAP captures payload.

Syslog severity 0=emergency through 7=debug; facility identifies the source subsystem.

Windows Event IDs: 4624 logon success, 4625 logon failure, 4688 process creation, 4720 account created, 1102 log cleared.

Log integrity: centralized collection, NTP-synchronized clocks, and append-only or WORM storage defend against tampering and timeline drift.

DNS tunneling indicators: high-volume TXT/NULL queries, long random subdomains, unusual query rates to a single authoritative server.

Firewall and proxy logs record 5-tuple plus action and bytes; proxy logs may hold full URLs and user-agent strings.

Timeline correlation requires normalized UTC timestamps; timezone offsets in logs must be resolved before ordering events.

Report structure: scope/authority, methodology, evidence inventory, findings, conclusions, limitations, appendices with hashes and tool versions.

Expert opinion admissibility (US): Daubert factors - testability, peer review, error rate, standards, general acceptance.

Federal Rules of Evidence: 702 expert testimony, 901 authentication, 1001-1006 writings and recordings, 803(6) business records.

Best evidence rule favors original media; forensic duplicates are admissible when authenticity and integrity are shown.

Report language: state facts and observations separately from interpretation; avoid conclusory legal statements.

Privilege: attorney-client and work-product protections may apply; document privilege claims and scope of review.

GDPR/Privacy: personal data in evidence requires lawful basis, minimization, and controlled access; retention limits apply.

Depositions and testimony: qualify as expert, explain methodology in plain terms, concede limits of findings honestly.

Evidence return/destruction: follow case retention policy and document disposition with signatures.