Forensics Fundamentals and Chain of Custody
Capture the volatile stuff first, image the disk, and prove nothing changed.
What you will learn
- -Order evidence collection by volatility so nothing perishable is lost
- -Image a drive bit for bit without altering the source
- -Prove evidence integrity with cryptographic hashing
A machine gets flagged for beaconing to a known bad IP, and you are handed the box. The moment you touch it, you start destroying evidence. Every command you run allocates memory, every second the power stays on overwrites something. Forensics is the discipline of collecting what matters before it disappears, in an order that loses the least, and proving afterward that you did not change a thing.
Order of volatility
Not all evidence rots at the same speed. RFC 3227 gives you the collection order, most perishable first. this order wrong and you lose data you can never get back.
The ranking, fastest to slowest to disappear: CPU and cache, then RAM and running process state, then connections and tables, then the disk itself, then remote , then physical configuration and archival media like backups. Registers are gone in nanoseconds. A pulled-and-imaged disk sitting in an evidence bag is stable for years.
The practical rule: capture volatile memory and network state on the live machine before you ever consider pulling the plug. If you shut down first to "preserve the disk", you just threw away RAM, which is where a fileless sample or an key often lives.
Image before you analyze
You never work on the original. You make a bit-for-bit copy, an image, and you investigate the copy. dd is the classic tool, but dc3dd adds and progress built in.
$sudo dc3dd if=/dev/sdb of=evidence.img hash=sha256 log=acquire.log$sudo ewfacquire /dev/sdb$sudo mount -o ro,loop evidence.img /mnt/caseThe if is your input (the suspect disk), of is the output file. Read the direction carefully. Swap them and you overwrite the evidence with a blank file, which has ended real cases.
Use a , a hardware device that sits between the suspect drive and your machine and physically refuses write commands. Software read-only mounts help, but a bad mount option or an eager OS can still touch the disk. Hardware is the guarantee.
Prove it did not change
An image is worthless in a report if you cannot show it matches the original. You hash the source, hash the image, and the two match. Then you re-hash later to prove nothing drifted while in your custody.
$sha256sum evidence.imgis the paper trail: who collected the evidence, when, from where, who has held it since, and where it was stored. Every handoff is logged and signed. A defense attorney will attack the weakest link, so an unexplained gap of even an hour can get evidence thrown out.
Acquiring a is copying the entire contents of someone's machine. Do it only on systems you own or have explicit written to examine. Unauthorized imaging is illegal in most places, and a signed engagement is what keeps you on the right side of it.
You arrive at a powered-on suspect machine. Which do you collect first?
You acquired evidence.img. Which command produces the fingerprint you record to prove it never changed?
sha256sum outputs a cryptographic hash of the file. Recorded at acquisition and re-run before reporting, a matching hash proves the image is bit-for-bit identical to what you collected.