Key Takeaways: Digital Forensics for Defenders

A scannable, reference-grade card for the chapter. Reread this before a cert exam or before your first real investigation. The golden rules, the artifact tables, the order of volatility, and the cert crosswalk are all here.

The five rules that decide every case

  1. Preserve before you remediate. Image and hash before you rebuild. Recovery from a copy; the original is sealed.
  2. Collect most-volatile first. Memory before disk. Never pull power on a live, un-captured system.
  3. Don't change the original; prove you didn't. Write blocker + SHA-256 hash of source and image (match = sound).
  4. Account for the evidence continuously. Chain of custody: who, when, from where, why — unbroken.
  5. Corroborate across independent sources. Especially off-host, append-only ones — they defeat anti-forensics.

Core definitions (one line each)

Term Definition
Digital forensics (DFIR) Methodical, repeatable, defensible preservation, acquisition, analysis, and reporting of digital evidence.
Order of volatility The rule to collect evidence from most-fragile (RAM) to least-fragile (backups) so durable collection doesn't destroy fragile evidence.
Chain of custody The documented, unbroken record of everyone who handled evidence, when, and why — proving it is unaltered.
Disk imaging Making a bit-for-bit, sector-by-sector copy of a device (incl. deleted files, slack/unallocated space).
Memory imaging Capturing RAM contents (processes, connections, injected code, in-memory secrets) — lost on power-off.
Write blocker Hardware/strict-software device that allows reads of an evidence drive but blocks all writes.
Forensic artifact Data left by normal activity that reveals what happened (registry, $MFT, logs, Prefetch).
Timeline analysis Merging timestamped events from many sources into one chronological narrative.
Indicator scoping Pivoting confirmed indicators (hash, account, IP) across the environment to find full extent.
Root-cause analysis Finding the underlying failure whose fix prevents recurrence (not the proximate symptom).
Anti-forensics Attacker techniques to hinder investigation: log clearing, timestomping, secure deletion, LOLBins.

Order of volatility (collect TOP → BOTTOM)

# Source Lost when…
1 CPU registers, cache power loss (instant)
2 RAM — processes, connections, injected code, in-memory keys power loss / reboot
3 Network state — ARP cache, routing, live connections, sockets continuously
4 Running system / kernel state, temp files reboot
5 Disk — filesystem, $MFT, registry, logs, slack/unallocated survives reboot; can be wiped
6 Off-host logs / SIEM (forwarded copies) survives the host
7 Physical config, topology stable
8 Backups, archival / write-once most durable

The mistake it prevents: pulling power / rebooting before memory capture (destroys 1–4). (RFC 3227; NIST SP 800-86.)

Sound acquisition checklist

  • [ ] Decide live-capture vs. power-off (favor live memory capture unless active destruction forces a power-off trade).
  • [ ] Memory capture first (trusted tool → external drive) on a live system.
  • [ ] Write blocker between analysis system and evidence drive (read-only).
  • [ ] Bit-for-bit image (not a file copy) — captures deleted files + slack space.
  • [ ] Hash source AND image (SHA-256); confirm MATCH = sound copy.
  • [ ] Analyze the image, never the original; original sealed, re-hashable.
  • [ ] Contemporaneous notes of every command (repeatability).
  • [ ] Chain-of-custody record started at collection; every handoff logged.

Hashing nuance: MD5/SHA-1 broken for collision resistance (adversarial); an MD5 match still detects accidental change. Record SHA-256 where integrity may be contested.

Principle What it requires
Authorization Right to collect (own systems / IR mandate); know privacy law; watch for legal hold.
Integrity Write blocker + hashing + custody record prove evidence unaltered.
Repeatability Another examiner reproduces findings from your notes + image.
Documentation Who/when/where/why for every item and handoff; analysis on the image.
Competence/tooling Validated tools; qualified interpretation; know when to involve counsel.

Legal hold: directive to preserve all potentially relevant data once litigation is anticipated; deleting it (even routine log rotation) can be spoliation. Authorization limit: reaching onto systems you don't control can be a crime and can taint evidence — gather only from systems you're entitled to.

Key artifacts — what each one proves

Windows

Artifact Answers… Notes
Registry USBSTOR Which USB devices connected, when Attached-device history
Registry Run/RunOnce How the attacker persisted Auto-start entries
Registry UserAssist / ShimCache Program execution / presence Execution evidence
$MFT (NTFS) When files were created/modified; deleted files MACB times; dual timestamps expose timestomping
Event ID 4624 / 4625 Successful / failed logon (+ logon type) type 3 = network, 10 = RDP
Event ID 4688 Process creation (what ran)
Event ID 7045 New service installed Common persistence/lateral move
Event ID 1102 Security log cleared Anti-forensic signal
Prefetch (.pf) A program actually ran (count, last run) Existence ≠ execution
Amcache / ShimCache Execution + presence history

Linux

Artifact Answers…
/var/log/auth.log or /var/log/secure Logins, sudo, SSH sessions
/var/log/syslog, systemd journal (journalctl) General system events
~/.bash_history Commands typed (absence/truncation = suspicious)
stat timestamps (atime/mtime/ctime) When files were touched
crontab, systemd units, startup scripts Persistence mechanisms

Timeline method (5 steps)

  1. Gather all timestamped sources (logs, $MFT, registry write times, network records).
  2. Normalize to UTC — convert every source's time zone.
  3. Account for clock skew — note any machine with a wrong clock.
  4. Tag each event's source, then merge and sort chronologically.
  5. Read it both ways — forward for the story; backward from impact to find initial access (patient zero).

Two timeline-killers: time-zone confusion and clock skew. Weighting: trust off-host, append-only sources most (hardest to tamper).

Scoping & root cause (the pivot)

file hash → which hosts? → which account placed it? → where did that
account log on? → what credential/entry point? → ROOT CAUSE
  • Scoping finds the full footprint (every host/account/data store) so eradication is complete.
  • Root cause is the underlying gap (e.g., VPN without MFA), not the symptom (ransomware ran). Its fix prevents recurrence and feeds the risk register and lessons learned (Ch. 24).
  • The reach to a sensitive data store determines breach-notification obligations — a bounded finding ("reached but not accessed/exfiltrated," corroborated by file-access times + off-host NetFlow) is the goal.

Anti-forensics — and the counter

Technique Detect it by Deny it by
Log clearing Event 1102; gaps in continuous logs Off-host, append-only forwarding
Timestomping $MFT dual timestamps disagree (detection-only; corroborate other sources)
Secure deletion of tools Prefetch shows it ran, but file gone Off-host telemetry of the execution
Empty/truncated history Absence on an active account auth.log / journal / NetFlow corroboration
Living-off-the-land (LOLBins) Anomalous use of built-in tools Behavioral detection (Ch. 22), command logging

Core stance: absence of evidence is evidence. You can't prevent every anti-forensic act — detect its traces and put evidence beyond the attacker's reach.

Common pitfalls

  • Pulling power on a live, un-captured system → volatile evidence gone (irreversible).
  • Copying files instead of imaging → misses deleted files, slack space; alters timestamps.
  • Analyzing the original drive → contaminates the authoritative evidence.
  • Trusting a single (attacker-reachable) source for the timeline → under-scopes the intrusion.
  • Neglecting chain of custody → perfect image, inadmissible evidence.
  • Overreaching onto systems you don't control → criminal exposure + tainted evidence.
  • Stopping at proximate cause → guaranteed recurrence.
  • Stating "stole/exfiltrated" instead of a bounded claim → indefensible in front of a regulator/court.

Framework & standard crosswalk

Framework Where this chapter maps
NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response — the chapter's primary standard.
NIST SP 800-61 IR lifecycle (Ch. 24); forensics supports detect/analyze, eradicate (scope), recover, lessons.
RFC 3227 Guidelines for Evidence Collection and Archiving — order of volatility.
NIST CSF 2.0 RESPOND (analysis), RECOVER; forensic readiness supports DETECT/PROTECT (logging).
MITRE ATT&CK Indicator Removal (T1070: log clearing, timestomping), Defense Evasion tactic.
CIS Controls v8 Control 8 (Audit Log Management) = forensic readiness; Control 17 (Incident Response).

Certification crosswalk

Concept CompTIA Security+ (ISC)² CISSP
Order of volatility Investigation/data sources Security Operations (investigations)
Chain of custody Forensics / incident response Security Operations; Legal/regulatory
Write blocker, imaging, hashing Forensic acquisition Digital forensics; evidence integrity
Legal hold, e-discovery, admissibility Forensics concepts Legal, Regulations, Investigations
Artifacts (logs, registry, $MFT) Data sources for investigation Conduct logging/monitoring; investigations
Anti-forensics Indicators / attack techniques Security Operations; ATT&CK evasion
Root-cause analysis Incident response process Security Operations; lessons learned

Project additions (this chapter)

  • Meridian program — forensic readiness standard: (1) evidence-handling procedure (order of volatility, write-blocker + hashing, chain-of-custody form); (2) forensic logging & retention (centralize 4624/4625/4688/7045/1102 + Linux auth/journal, append-only, months of retention); (3) host visibility (memory capture + fleet-wide indicator search); (4) legal-hold & escalation (when counsel/HR are engaged).
  • bluekit/forensics.py: evidence_hash(data, expected) → integrity verification (SHA-256 match); merge_timeline(sources) → normalize + sort multi-source events into one chronological timeline.
  • Anchors advanced: the Meridian ransomware case (Ch. 24) carried into forensics — root cause (VPN without MFA), eleven-day dwell, four-host scope, bounded "PII reached but not exfiltrated" finding.