Cyber and Digital Evidence Awareness
Cyber and Digital Evidence Awareness
This domain tests whether you can recognize, preserve, and request digital evidence without destroying it. You are not expected to be a forensic examiner, but you are expected to know volatility, legal process, chain of custody, and the limits of your own handling.
Core rules
- Digital evidence is fragile and volatile. Preserve first: isolate devices from networks, document screen state, and avoid browsing, opening apps, or answering calls.
- Know the legal tool: consent, warrant, subpoena, preservation letter, or court order. Provider records, cloud accounts, and third-party platforms usually require legal process.
- Maintain chain of custody for devices and media. Record make, model, serial number, condition, power state, and every transfer.
- Use forensic examiners and write blockers. Do not use the suspect's credentials or install software on a seized device.
- Ask focused questions: which account, which time window, which application, which data type. Metadata and logs can establish timestamps and associations, but they need interpretation.
Worked example
A phone is seized in an assault investigation. If it is on, place it in a signal-blocking bag or enable airplane mode without exploring content; if it is off, leave it off unless policy directs otherwise. Document the state, obtain legal authority for extraction, and submit it to a forensic examiner. Do not scroll through photos to 'see what's there.'
Traps
Turning a device on; using a suspect's password; assuming deleted data is gone; ignoring cloud or provider records; and failing to document the device's condition at seizure.