Digital Forensics Fundamentals
Domain 1 - Digital Forensics Fundamentals
This domain tests the vocabulary and method behind a defensible digital investigation: what counts as digital evidence, how the forensic process is sequenced, and why repeatability matters. Expect questions that distinguish live from dead-box acquisition and ask which action comes first.
Core rules
- Digital evidence is any data with probative value stored or transmitted in binary form; it is fragile, easily altered, and often latent.
- NIST SP 800-86 groups the process into collection (including preservation), examination, analysis, and reporting; many models add identification and acquisition as explicit steps. Preservation precedes acquisition; acquisition precedes analysis.
- RFC 3227 order of volatility: CPU registers and cache, routing table/ARP cache/process table/memory, temporary file systems, disk, remote logs, archival media. Collect the most volatile first when a system cannot be imaged or must stay running.
- ACPO principles: no action changes data; if it must, the investigator must be competent and explain why; create and retain an audit trail; the case officer is responsible.
- Hashing (SHA-256 preferred; MD5 still seen) proves integrity; hash before and after acquisition. A matching hash supports that the image equals the source, not that the source is authentic.
- Write blockers prevent host writes; documentation, chain of custody, and tool validation support admissibility.
Worked example
A laptop is suspected of data theft and is still logged in. The examiner photographs the screen, records the system clock and network state, collects memory and volatile command output, then performs a controlled shutdown and images the disk through a write blocker. Reasoning: volatile data would be lost on power-off, but disk evidence remains; the order follows volatility and preserves the best evidence for analysis. Each step is logged.
Traps
Shutting down first; imaging through a live OS; hashing only once; treating a hash match as proof of authorship; skipping tool version notes; conflating examination with analysis.