Forensic Investigation Methodology and Evidence Handling
What the domain tests
Forensic methodology and evidence handling: can you preserve volatile and nonvolatile evidence, document it, and explain why an action is sound? Expect questions on order of volatility, imaging, hashing, chain of custody, and live response.
Core rules
- Follow identify, preserve, acquire, examine, analyze, report. Preserve first; analysis later.
- Order of volatility: CPU/cache, memory, network state (ARP, connections), running processes, temp files, disk, logs, backups, archival media. Capture memory before shutdown when feasible.
- Use a write blocker for disk acquisition; image to a forensic copy; verify with SHA-256 (or MD5 plus SHA-256) before and after; work on copies.
- Chain of custody records who handled evidence, what was done, when, where, and why, with signatures and tamper-evident storage.
- Document commands, tool versions, time zone (UTC), and deviations. Live response changes state; record every command.
Worked example
A POS server is suspected of RAM scraping. You photograph the scene, isolate the network at the switch (not by powering off), capture memory, record netstat and process listings, then image the disk with a write blocker. You hash the image and store the original disk sealed. Reasoning: powering off destroys memory-resident track data; network isolation limits exfiltration while preserving state; hashes prove integrity.
Traps
Collecting disk before memory; logging into the suspect host interactively; hashing only after analysis; treating chain of custody as court-only; forgetting time-zone normalization; assuming a VM snapshot is a forensic image.