CNFE cheat sheet

Forensic soundness rests on three properties: authenticity (data is what it claims), integrity (data unaltered, provable by hash), and completeness (no relevant data omitted).

Order of volatility (RFC 3227): CPU registers/cache > RAM > swap/temp > network state (ARP, routing, connections) > disk > remote logs > archival media. Capture the most volatile first.

Chain of custody record fields: item identifier, description, collector name, date/time (with timezone), location, hash value, transfer signatures, storage conditions.

Fourteenth Amendment / Katz reasonable-expectation-of-privacy test governs whether network monitoring of an employee or subscriber is a search; consent and banner notice shift the analysis.

Stored Communications Act (18 U.S.C. 2701-2713) governs voluntary disclosure of stored subscriber content; 2703(f) preservation letter compels retention for 90 days, extendable 90 more.

Pen Register / Trap and Trace statute (18 U.S.C. 3121-3127) covers real-time dialing, routing, addressing, and signaling metadata; it does not authorize capture of message content.

Wiretap Act (18 U.S.C. 2510-2522) covers real-time interception of content; one-party consent exception applies where the interceptor is a party or has a party's consent, subject to state law variation.

Federal Rules of Evidence 901 requires authentication (hash, witness testimony, tool validation); 902(13)/(14) permit self-authenticating certified records of machine-generated data and hash values.

Daubert factors for expert admissibility: testability, peer review/publication, known error rate, standards and controls, general acceptance. Frye (general acceptance only) still applies in some state courts.

Ethernet II frame: 7-byte preamble, 1-byte SFD, 6-byte destination MAC, 6-byte source MAC, 2-byte EtherType (0x0800 IPv4, 0x0806 ARP, 0x86DD IPv6, 0x8100 VLAN tag), payload 46-1500 bytes, 4-byte FCS.

IPv4 header is 20 bytes minimum; IHL field gives length in 32-bit words. Fragmentation uses Identification, Flags (DF, MF), and Fragment Offset in 8-byte units.

TCP three-way handshake: SYN, SYN-ACK, ACK. Flags byte bits: FIN 0x01, SYN 0x02, RST 0x04, PSH 0x08, ACK 0x10, URG 0x20, ECE 0x40, CWR 0x80.

TCP sequence-number analysis detects injection and desync: relative sequence numbers in a capture hide the true ISN; disable relative sequence in the analyzer to compare.

DNS over UDP/53 truncation (TC flag) forces TCP/53 retry. Common record types: A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV.

TLS handshake: ClientHello (SNI, cipher suites, extensions) -> ServerHello + Certificate -> key exchange -> ChangeCipherSpec -> Finished. SNI is cleartext in TLS 1.2 and typically visible in TLS 1.3 unless ECH is used.

DHCP DORA: Discover, Offer, Request, Acknowledge. Rogue DHCP server detection looks for multiple OFFERs to one DISCOVER or a server IP not in the authorized list.

ARP has no authentication; gratuitous ARP and duplicate ARP replies with changing MAC-to-IP mappings indicate ARP spoofing or MITM positioning.

ICMP type/code pairs for tunneling and recon: Type 8 Echo Request, Type 0 Echo Reply, Type 3 Destination Unreachable, Type 11 Time Exceeded. Large or non-standard payloads in Type 8 warrant inspection.

Full packet capture vs. flow records: PCAP retains payload for content analysis; NetFlow/IPFIX retains header metadata only. Choose based on legal scope and storage budget.

Capture sizing formula: bytes = pps x average frame size x seconds. At 10,000 pps with 500-byte frames for 3600 s, that is 18 GB before overhead.

SPAN/mirror port caveats: oversubscription drops frames, and the mirror may strip or rewrite FCS. TAP devices preserve line-rate fidelity and are preferred for evidentiary capture.

Promiscuous mode is required to see unicast frames not addressed to the NIC; monitor mode is required for 802.11 frames including management and control frames.

tcpdump snaplen (-s 0) captures full frames; a reduced snaplen truncates payload and can destroy evidence. BPF filter strings must be documented as part of acquisition method.

Hash at acquisition: SHA-256 of the capture file at completion and again before analysis; matching hashes establish integrity. Record hash algorithm, tool version, and timestamp.

Timestamps: capture hosts must be NTP-synchronized. Record the capture system timezone and offset from UTC; pcapng supports per-interface resolution and comments.

Ring buffer (-C size, -W count) overwrites older files; verify retention window covers the incident period before relying on it for evidence.

Snort/Suricata rule anatomy: action (alert, drop, pass) protocol source_ip source_port -> destination_ip destination_port (options), with sid and rev required for tracking.

Rule option keywords: msg, content, nocase, depth, offset, distance, within, flow:established, flags, threshold, detection_filter, reference, classtype.

Signature types: atomic (single pattern), stateful (multi-packet, e.g., flowbits), anomaly-based, and protocol-conformance. Stateful signatures catch fragmented or split attacks.

Alert fatigue metrics: false positive rate = FP / (FP + TN); precision = TP / (TP + FP). Tune by suppression, thresholding, and whitelisting known-good hosts.

Windows Event IDs of forensic value: 4624 logon (types 2 interactive, 3 network, 10 RDP), 4625 failed logon, 4648 explicit credentials, 4672 special privileges, 4688 process creation, 4720 account created, 7045 service installed.

Linux auth logs: /var/log/auth.log or /var/log/secure record sshd Accepted/Failed password, sudo commands, and su sessions; correlate source IP against firewall and DHCP logs.

Syslog severity (RFC 5424): 0 Emergency through 7 Debug. Facility and severity are encoded in PRI = facility x 8 + severity.

Beaconing detection: low variance in inter-connection intervals (jitter analysis), consistent payload size, and repeated DNS lookups to a single domain at regular intervals.

Correlation rule: an IDS alert becomes an incident candidate when corroborated by a second independent source such as firewall deny logs, proxy logs, or endpoint telemetry.

IOC categories: network (IP, domain, URI, JA3/JA3S, certificate serial), host (file hash, mutex, registry key, service name), and behavioral (persistence, C2 interval, encryption pattern).

JA3 fingerprint = MD5 of TLS ClientHello fields: version, cipher suites, extensions, elliptic curves, EC point formats, joined with commas and dashes. JA3S is the server-side analogue.

DGA detection signals: high NXDOMAIN ratio, high entropy in the second-level label, uniform label length, and bursty lookups followed by one successful resolution.

Fast flux and domain fronting: rapidly rotating A records indicate fast flux; mismatched SNI versus HTTP Host header indicates domain fronting through a CDN.

Common C2 patterns: HTTP POST with base64 or hex body to a URI path such as /gate.php; DNS TXT tunneling with long encoded subdomains; ICMP payloads exceeding normal size.

Ransomware network precursors: SMB lateral connections to many hosts on 445, RDP 3389 bursts, Volume Shadow Copy deletion (vssadmin), and connections to known exfiltration endpoints.

Malware sandbox artifacts: pcap, process tree, dropped files with hashes, and DNS/HTTP request logs. Sandbox egress is often proxied, so observed IPs may be the sandbox, not the C2.

Payload extraction: follow the TCP stream, export objects (HTTP/SMB), decode base64, and verify with a hash before submitting to any external service; strip sensitive data first.

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Containment strategy is chosen by cost, scope, and attacker awareness.

Containment options ranked by disruption: host isolation via NAC/VLAN change, ACL block at the perimeter, DNS sinkhole, full segment disconnection. Preserve volatile state before isolating.

Network investigation pivot sequence: alert -> session metadata -> full packet -> host telemetry -> identity logs. Each pivot must be logged with query, time range, and result count.

Scope determination: enumerate all hosts that communicated with the C2 IP/domain within the exposure window, then check for secondary internal spread via SMB, RDP, or WMI.

Timeline normalization: convert all sources to UTC, record clock skew per source, and order events by both event time and ingestion time to expose delayed logging.

Eradication verification requires negative evidence: no further C2 connections, no persistence artifacts, and clean re-scan after credential rotation.

Lessons-learned output: detection gap, time-to-detect, time-to-contain, and specific control changes with owners and due dates.

Legal hold and notification triggers: breach-notification statutes key on unauthorized acquisition of personal data; counsel determines thresholds, not the forensic analyst.

Report structure: scope and authority, methodology and tools with versions, evidence inventory with hashes, findings with supporting packet references, limitations, and conclusions.

Every finding must cite a reproducible artifact: capture file name, frame number, timestamp in UTC, and the filter used to isolate it.

Two report audiences: technical (appendix with filters, hashes, tool output) and executive (impact, timeline, root cause, recommendations). Keep the two clearly separated.

Expert witness gatekeeping: qualification, reliability of method, helpfulness to the trier of fact, and fit to the facts. Lay opinion is limited to personal observation.

Deposition and testimony discipline: answer the question asked, distinguish observation from inference, and state uncertainty explicitly rather than estimating beyond the data.

Common impeachment lines: unvalidated tool, undocumented filter change, clock skew not addressed, chain-of-custody gap, and conclusions exceeding the analyzed scope.

Retention: retain original evidence, working copies, tool output, and notes for the period set by statute of limitations or legal hold; document any destruction.

Wireshark display filters: ip.addr == 10.0.0.5, tcp.port == 443, http.request.method == "POST", dns.qry.name contains "evil", tls.handshake.extensions_server_name == "x", frame contains "string".

Capture filters use BPF syntax (host 10.0.0.5 and port 80); display filters use Wireshark syntax. They are not interchangeable and the distinction is a common error.

tshark export: -r input.pcap -Y filter -T fields -e frame.time -e ip.src -e ip.dst -e tcp.stream for structured extraction; -z follow,tcp,ascii,0 to reassemble a stream.

Zeek (formerly Bro) produces conn.log, dns.log, http.log, ssl.log, and files.log; each record has uid and ts fields enabling cross-log joins.

NetworkMiner parses a pcap into host profiles, credentials, and extracted files without replaying traffic; useful for rapid triage of a single capture.

Volatility for memory: imageinfo, pslist, netscan, malfind, dlllist, handles. netscan recovers connections absent from disk-based logs.

Tool validation: compare output across two independent tools (e.g., tshark and Zeek) on the same capture; document version, build, and any known defects.

Reproducibility: store the exact command line, filter, tool version, and hash of input for every analysis step so a third party can re-run it.