Digital Forensics Fundamentals¶

Digital forensics is the disciplined collection, preservation, and analysis of digital evidence — to understand an incident and, when needed, support legal action.

The Core Principles¶

1. 1.Preserve, then analyze — never work on original evidence; work on verified copies.
2. 2.Order of volatility — collect the most fleeting data first:

CPU registers / cache RAM (memory) Network state, running processes Disk Logs / archived data Backups ← least volatile

1. 1.Integrity via hashing — hash evidence (SHA-256) at acquisition; re-hash to prove it's unchanged.
2. 2.Chain of custody — document who handled evidence, when, and why. A broken chain can make evidence inadmissible.

Acquisition¶

• Memory capture — RAM holds running malware, keys, network connections, and fileless artifacts that vanish on shutdown. Don't pull the plug before capturing memory if feasible.
• Disk imaging — bit-for-bit forensic image (e.g., with a write-blocker to prevent altering the source).

Analysis Areas¶

Common Tools (Awareness)¶

• Autopsy / The Sleuth Kit — disk forensics.
• Volatility — memory analysis.
• Wireshark — packet analysis.
• FTK Imager — acquisition/imaging.

Forensics vs. Incident Response¶

IR aims to contain and recover fast; forensics aims to understand deeply and preserve evidence. They can conflict (wiping a box quickly destroys evidence), so coordinate: decide early whether legal action is likely, and preserve accordingly.

Anti-Forensics¶

Attackers actively try to defeat forensics: clearing logs, timestomping (altering file times), encryption, and fileless techniques. This is why off-host, tamper-resistant logging (Chapter 8) is so valuable — it survives even when the endpoint is scrubbed.

The Reporting Outcome¶

Forensic work culminates in a clear, factual report: a timeline of events, root cause, scope of impact, and recommendations — written so both technical teams and non-technical stakeholders can act on it.