Digital Forensics: Defensible Process, Acquisition, and Artefact Interpretation
The Digital Forensics domain tests whether you can run an investigation that survives cross-examination: preserve evidence, acquire it without alteration, interpret artefacts correctly, and report conclusions tied to specific findings. Expect questions on process models, chain of custody, hashing, volatile-data ordering, and file-system and Windows artefact interpretation.
Process and preservation
NIST SP 800-86 describes four phases: collection, examination, analysis, reporting. The ACPO principles add four duties: no action should change the data; where change is unavoidable the examiner must be competent and able to explain it; an audit trail must let a third party reproduce the result; the case officer carries overall responsibility. Locard's exchange principle cuts both ways - the offender leaves traces, and so does the examiner.
Acquisition
Order of volatility (RFC 3227): CPU registers and cache, then RAM and the process table, then network state such as ARP and routing tables, then temporary files, then disk, then remote logs, then archival media. Dead acquisition uses a hardware or software write blocker. Hash before and after imaging, preferring SHA-256 while still recording MD5 for legacy interchange. Record tool name and version, blocker model and serial, and both hash values in the chain of custody.
Artefacts
NTFS timestamps live in two places: $STANDARD_INFORMATION and $FILE_NAME within each $MFT record. Registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT), Prefetch, Amcache, $UsnJrnl and $LogFile all corroborate user activity. Deleted content persists in unallocated and slack space; carving relies on file signatures, not file-system metadata.
Worked example
A suspect file shows $SI Created 2019-03-02 but $FN Created 2021-11-14, with identical modification times in both sets. Reasoning: user-mode calls such as SetFileTime rewrite $STANDARD_INFORMATION, whereas $FILE_NAME timestamps are refreshed by the file system on rename or move. The $SI creation value is therefore unreliable; confirm the real creation event against $UsnJrnl and $LogFile rather than quoting it in the report.
Traps that cost marks
- A hash match proves integrity, not authenticity or completeness.
- Deletion does not erase; assuming it does discards recoverable evidence.
- Tool timelines are usually UTC; local-time assumptions corrupt the sequence.
- Imaging before photographing and documenting the scene breaks the audit trail.
- Successful carving does not attribute a file to a user or a file system.