Digital Forensics and Evidence Collection
Digital Forensics and Evidence Collection
This domain tests whether you can collect and preserve digital evidence so it remains reliable and defensible. OSIR-style questions often ask you to order collection steps, choose the right acquisition method, or identify a chain-of-custody failure.
Core rules and concepts
- Follow the order of volatility from RFC 3227: collect registers/cache, RAM, network state, running processes, disk, remote logs, and archival media in that general order, adapting to the case.
- Use a write blocker for disk acquisition and create a forensic image, not a logical copy, when possible. Hash the image at acquisition and verify the hash later.
- Maintain chain of custody: who collected, when, where, from what device, using what tool, and every transfer. Gaps undermine admissibility and trust.
- ISO/IEC 27037 gives guidance on identifying, collecting, acquiring, and preserving digital evidence. Legal hold suspends routine deletion.
- Document tool versions, commands, time zones, and any changes. Prefer validated tools and reproducible steps.
Worked example
A laptop is suspected of malware execution. Reasoning: if it is still running and policy permits, capture volatile data first: memory image, network connections, logged-on users, and running processes. Then isolate it from the network and acquire a disk image with a write blocker. Hash both memory and disk images, record hashes in the case notes, and store evidence in tamper-evident packaging. Do not boot from the suspect disk or analyze the original; use a verified copy. If the device is off, do not power it on just to "check" it.
Traps
Do not collect disk before volatile data when memory matters; do not use the original evidence for analysis; do not omit hash verification; do not break custody by loaning evidence without documentation.