Digital Forensics
Establishing what happened, in what order, with evidence that survives scrutiny.
Answering Four Questions
Forensics exists to establish what happened, when, how, and what was affected — reliably enough that the answer holds up in an incident review, a regulatory submission or a court.
That tension is real and needs a decision made in advance: how long the business will tolerate an affected system staying isolated but intact before it is wiped. Deciding during the incident means the pressure wins.
Order Of Volatility
Evidence disappears at different rates. Collect in order of how quickly it is lost, or it is gone before you reach it.
| Priority | Source | Lifetime |
|---|---|---|
| 1 | CPU registers and cache | Nanoseconds |
| 2 | Memory — running processes, connections, keys | Until power off |
| 3 | Network state and active sessions | Seconds to minutes |
| 4 | Running system state and temp files | Until reboot |
| 5 | Disk contents | Until overwritten |
| 6 | Remote and archived logs | Retention period |
Acquisition & Chain Of Custody
Work from a copy, never the original, and be able to prove the copy is faithful.
| Practice | Why |
|---|---|
| Bit-for-bit image, not a file copy | Deleted data and slack space matter |
| Hash before and after | Proves the image was not altered |
| Write blocker on the source | Prevents the acquisition changing the evidence |
| Analyse the copy only | The original stays pristine for verification |
| Documented chain of custody | Who held it, when, and why — unbroken |
In cloud environments the equivalents are snapshots, immutable audit logs and preserved instance metadata — with the same discipline of copying, hashing and documenting.
Timeline Analysis
The core technique is building a single ordered timeline from every source — filesystem timestamps, event logs, application logs, network flows, cloud audit trails — and reading the story it tells.
| Watch for | Meaning |
|---|---|
| First anomalous event | Candidate for initial access |
| Gaps in logging | Deliberate clearing, or a collection failure |
| Timestamps out of sequence | Anti-forensics, or clock skew between sources |
| Activity outside working hours | Automation, or an adversary in another timezone |
| Lateral movement | The same account appearing on new hosts |
Reporting Findings
| Include | Detail |
|---|---|
| Scope and method | What was examined and how it was acquired |
| Timeline | The sequence, with the evidence for each step |
| Impact | What data and systems were actually affected |
| Root cause | How they got in, stated plainly |
| Confidence | What is proven, what is inferred, what is unknown |
| Remediation | What must change so this specific path closes |
Interview Questions
What is the order of volatility?
Collect evidence in order of how fast it disappears: registers and cache, memory, network state, running system state, disk, then archived logs.
Why capture memory before shutting a machine down?
Memory holds running processes, live connections, decryption keys and malware that never touches disk. Powering off destroys all of it.
What is chain of custody and why does it matter?
A documented record of who held the evidence, when and why. Without it, technically sound findings carry little weight in a legal or regulatory setting.
Why image rather than copy files?
A bit-for-bit image preserves deleted data, slack space and metadata that a file copy loses — and hashing it proves the copy was not altered.
What is the most common timeline mistake?
Correlating timestamps in mixed local timezones. Normalising everything to UTC first is what prevents a confident but wrong sequence of events.
How should uncertainty appear in a forensic report?
Explicitly. Facts, inferences and unknowns must be labelled differently, because decisions are made on the report and inference presented as fact misleads them.