Principles of Information Security: Digital Forensics (Chain of Custody, Evidence Collection, Memory Forensics)

Digital Forensics (Chain of Custody, Evidence Collection, Memory Forensics)

Digital Forensics Study Guide: Chain of Custody, Evidence Collection & Memory Forensics

(For CISSP, Security+, CEH, and Real-World Security Roles)

What This Is

Digital forensics is the scientific process of collecting, preserving, analyzing, and presenting electronic evidence to investigate cybercrimes, data breaches, or policy violations. It’s critical because sloppy evidence handling can make findings inadmissible in court (e.g., a ransomware attack where logs were deleted due to improper collection) or miss critical attacker footprints (e.g., malware hiding in RAM that disappears after a reboot). Example: In the 2017 Equifax breach, poor forensic practices delayed containment, allowing attackers to exfiltrate 147 million records over months.

Key Terms & Concepts

• Digital Forensics (DF): The process of uncovering and interpreting electronic data for legal or investigative purposes. Follows NIST SP 800-86 and ISO/IEC 27037 guidelines.

• Subfields: Disk forensics, memory forensics, network forensics, mobile forensics.

• Chain of Custody (CoC): A documented, tamper-evident trail showing who handled evidence, when, and why. Required for legal admissibility (e.g., in court or HR investigations).

• Tools: FTK Imager (for hashing), Chain of Custody Forms (paper/electronic logs).

• Standards: NIST SP 800-101 (mobile forensics), ISO/IEC 27043 (incident investigation).

• Evidence Integrity: Ensuring data is unchanged from collection to presentation. Achieved via cryptographic hashing (e.g., SHA-256).

• Example: If a forensic image’s hash changes, the evidence is compromised and may be thrown out in court.

• Write Blocker: A hardware/software tool that prevents accidental writes to a storage device during acquisition (e.g., Tableau TD3, FTK Imager).

• Why? Modifying evidence violates integrity and breaks the chain of custody.

• Memory Forensics: Analyzing volatile data (RAM, CPU registers) to detect malware, rootkits, or attacker activity that disappears after reboot.

• Tools: Volatility (open-source), Rekall, Magnet RAM Capture.

• Key Artifacts: Running processes, network connections, injected code, encryption keys.

• Live Forensics: Collecting data from a running system (e.g., RAM, open files) before shutting it down. Used when volatile data is critical (e.g., ransomware in memory).

• Risk: Actions may alter system state (e.g., running tools can overwrite evidence).

• Dead Forensics: Analyzing data from a powered-off system (e.g., disk images). Safer for integrity but misses volatile data.

• Tools: Autopsy, EnCase, dd (Linux disk imaging).

• Order of Volatility (OoV): A NIST SP 800-86 guideline prioritizing evidence collection from most to least volatile:

• CPU registers, cache (microseconds)
• RAM (seconds)
• Network state (minutes)
• Running processes (minutes)
• Disk (persistent)

• Backups/archives (long-term)

• Forensic Image: A bit-for-bit copy of a storage device (e.g., HDD, SSD, USB) preserved in a forensic container (e.g., .E01, .AFF).

• Tools: FTK Imager, Guymager, dd (Linux).

• Anti-Forensics: Techniques attackers use to hide, destroy, or mislead forensic investigations (e.g., timestomping, file wiping, steganography).

• Example: CCleaner deleting logs, Mimikatz clearing memory artifacts.

• Legal Hold: A court order requiring an organization to preserve all relevant data (e.g., emails, logs) for litigation. Failure to comply can result in sanctions (e.g., $9B fine in the 2016 Waymo vs. Uber case).

• Volatile Data: Data that disappears when power is lost (e.g., RAM, ARP cache, open network connections). Must be collected first in live forensics.

Step-by-Step / Process Flow

1. Preparation (Before an Incident)

• Create a forensic toolkit (write blockers, sterile media, imaging tools, chain-of-custody forms).
• Train staff on evidence handling (e.g., never touch original media, document everything).
• Define roles (e.g., First Responder, Forensic Analyst, Legal Counsel).

2. Identification & Triage

• Determine scope: Is this a criminal case (law enforcement), HR investigation, or incident response?
• Assess volatility: If the system is on, prioritize RAM collection (e.g., volatility -f mem.dump imageinfo).
• Document the scene: Take photos/videos of the system (e.g., cables, screen, BIOS time).

3. Evidence Collection (Follow Order of Volatility)

4. Preservation & Chain of Custody

• Store evidence in a secure location (e.g., forensic lab with access logs).
• Update CoC form every time evidence changes hands (e.g., "Transferred from Analyst A to Analyst B at 14:30 on 2024-05-20").
• Maintain a working copy (never analyze the original evidence).

5. Analysis

• Disk forensics: Recover deleted files (Autopsy), analyze registry hives (RegRipper).
• Memory forensics: Detect malware (volatility malfind), extract passwords (mimikatz from memory dumps).
• Timeline analysis: Correlate events (e.g., log2timeline for supertimeline).

6. Reporting & Presentation

• Write a forensic report (clear, non-technical for legal teams):
• Executive summary (what happened?)
• Methodology (tools, steps taken)
• Findings (evidence, timestamps, attacker TTPs)
• Conclusion (root cause, recommendations)
• Prepare for testimony (if needed): Stick to facts, avoid speculation.

Common Mistakes

Certification Exam Tips

CISSP

• Focus on legal/management aspects: CISSP tests admissibility of evidence, chain of custody, and forensic readiness (e.g., "Which standard governs digital evidence handling?" → ISO/IEC 27037).
• Know the difference between:
• Live vs. dead forensics (CISSP loves this distinction).
• Volatile vs. non-volatile data (RAM vs. disk).
• ⚠️ Trap: CISSP may ask about forensic tools but expects you to know processes (e.g., "What’s the first step in evidence collection?" → Document the scene).

Security+

• Memorize Order of Volatility (NIST SP 800-86) – guaranteed question.
• Know basic tools: dd, FTK Imager, Autopsy, Volatility.
• ⚠️ Trap: Security+ may ask about anti-forensics (e.g., "Which technique hides data in images?" → Steganography).

CEH

• Hands-on focus: CEH tests practical skills (e.g., "How would you extract a password from RAM?" → Volatility’s mimikatz plugin).
• Know attacker TTPs: CEH loves anti-forensics (e.g., timestomping, file wiping).
• ⚠️ Trap: CEH may ask about legal jurisdictions (e.g., "Which law governs digital evidence in the EU?" → GDPR).

Quick Check Questions

1. During a ransomware investigation, the forensic analyst shuts down the infected workstation before collecting RAM. What critical evidence is most likely lost?

• A) Deleted files on the hard drive
• B) Encryption keys in memory
• C) Network connection logs
• D) BIOS settings
  ✅ Correct Answer: B
  Explanation: RAM is volatile and contains encryption keys, running processes, and malware artifacts that disappear on shutdown.

2. Which of the following is the BEST way to ensure the integrity of a forensic disk image?

• A) Compressing the image to save space
• B) Calculating a SHA-256 hash before and after acquisition
• C) Storing the image on a shared network drive
• D) Using a write blocker only during analysis
  ✅ Correct Answer: B
  Explanation: Hashing (SHA-256) verifies that the image hasn’t been altered from the original evidence.

3. A forensic analyst is preparing to testify in court about evidence collected from a compromised server. Which document is MOST critical to prove the evidence was not tampered with?

• A) Incident response report
• B) Chain of custody log
• C) Server configuration backup
• D) Malware analysis report
  ✅ Correct Answer: B
  Explanation: The chain of custody log proves who handled the evidence, when, and why, ensuring legal admissibility.

Last-Minute Cram Sheet

1. Chain of Custody (CoC) = Documented trail of evidence handling (NIST SP 800-101).
2. Order of Volatility (OoV) = RAM → Network → Disk → Backups (NIST SP 800-86).
3. Write Blocker = Prevents writes to evidence (hardware/software).
4. Forensic Image = Bit-for-bit copy (.E01, .AFF formats).
5. Memory Forensics Tools = Volatility, Rekall, Magnet RAM Capture.
6. Hashing = SHA-256 (verify evidence integrity).
7. Live Forensics = Collect RAM first (volatile data).
8. Dead Forensics = Powered-off system (safer for integrity).
9. ⚠️ Anti-Forensics = Timestomping, file wiping, steganography.
10. Legal Hold = Court order to preserve data (or face sanctions).