Core Forensic Pillars & Terminology

1. Core Forensic Pillars & Terminology

To ensure findings stand up to legal and administrative scrutiny, every investigation must adhere to three non-negotiable principles:

• Data Integrity: Maintaining the original state of evidence. No action taken by the investigator should alter data on the target media.
• Chain of Custody: A continuous, unbroken, and meticulously detailed log documenting who secured, handled, transferred, and analyzed the evidence.
• Reproducibility: A qualified third-party forensic expert must be able to replicate your steps using the same tools and methodologies and arrive at the exact same conclusion.

Standardized Terminology

• Order of Volatility (OOV): The sequence in which data must be collected based on how fast it disappears from a system (e.g., CPU cache vs. a hard drive).
• Write-Blocker: A hardware or software device that prevents a forensic workstation from writing data to the suspect storage media during acquisition.
• Bit-Stream Image: A bit-by-bit clone of the original media, capturing all hidden data, deleted files, and unallocated space (distinct from a standard file copy).
• Cryptographic Hash: A unique mathematical fingerprint of a data set (using algorithms like SHA-256) used to verify data integrity before and after analysis.

2. Order of Volatility Decision Matrix

When responding to an active system, data must be captured starting with the most fragile components. Use this matrix to prioritize your live acquisition steps:

Volatility Priority	Component	Typical Lifespan / Risk Factor	Examples of Extracted Artifacts
Priority 1	CPU Cache & Registers	Nanoseconds / Instantly overwritten	Processor state, active instruction threads.
Priority 2	Routing Table, ARP & Memory	Seconds to Minutes / Lost on power-down	Volatile RAM, active network connections, running processes, unencrypted passwords.
Priority 3	Temporary File Systems	Minutes to Hours / Cleared by OS processes	App temporary files, swap space, pagefiles.
Priority 4	Disk Storage (Non-Volatile)	Years (Unless physically destroyed)	OS installation files, user documents, deleted file structures.
Priority 5	Remote Logging & Backups	Independent / Subject to retention policies	SIEM logs, cloud backups, network firewall logs.

3. Standard Operating Procedure (SOP): The 4-Phase Workflow

[Phase 1: Identification & Identification] ➔ [Phase 2: Acquisition & Preservation] ➔ [Phase 3: Analysis & Extraction] ➔ [Phase 4: Reporting & Presentation]  
  

Phase 1: Identification & Incident Isolation

• Define Scope: Identify the target systems, cloud environments, or mobile devices involved in the incident.
• Isolate the Threat: Disconnect the affected system from the local network (unplug the Ethernet cable or disable Wi-Fi) to stop ongoing data exfiltration or remote tampering.
• Secure the Physical Scene: Photograph the device, its surroundings, and any visible cabling before touching the hardware.

Phase 2: Acquisition & Preservation

• Live vs. Dead Acquisition: If the system is powered on, collect volatile RAM first (Phase 2a). If it is powered off, do not power it on; proceed directly to static acquisition (Phase 2b).
• Deploy Write-Blockers: Connect the suspect drive to a forensic workstation via a verified hardware write-blocker.
• Generate Forensic Image: Create a bit-stream image using standard formats (such as .E01 or raw .dd).
• Establish Baseline Integrity: Calculate the SHA-256 hash value of the original drive immediately upon acquisition. Match this against the hash of the generated image to verify a perfect copy.

Phase 3: Analysis & Evidence Extraction

• Work Exclusively on Copies: Never analyze the original evidence drive. Work only on verified working copies of the forensic image.
• Timeline Analysis: Reconstruct a master timeline of events by analyzing system timestamps (MACB: Modified, Accessed, Created, Born).
• Artifact Deep-Dive: Examine key operating system artifacts:
  • Windows Registry: For user activity, execution history, and connected USB devices.
  • Event Logs: For authentication failures, service state changes, and lateral movement.
  • Unallocated Space: For carved fragments of deleted files.

Phase 4: Reporting & Legal Presentation

• Executive Summary: A high-level overview of the incident, the impact, and the ultimate findings written for non-technical stakeholders.
• Technical Methodology: A granular, step-by-step log detailing the tools used, software versions, and specific commands executed.
• Chain of Custody Attachment: A copy of the signed forms tracking the physical movement of all evidence media.

4. Evidence Handling & Chain of Custody Template

Every piece of evidence collected must be tagged with a standardized tracking block.

Evidence Control Log

• Case Reference Number: ___________________________
• Evidence Item ID: ___________________________
• Description of Item (Make, Model, Serial Number): ___________________________
• Source Location / Device Owner: ___________________________
• Acquisition Date & Time (UTC): ___________________________
• Acquisition Hash Value (SHA-256): ___________________________

Chain of Custody Transfer History

Date & Time (UTC)	Released By (Name & Signature)	Received By (Name & Signature)	Purpose of Transfer
DD/MM/YYYY --:--			Initial collection and transport to lab.
DD/MM/YYYY --:--			Secure evidence locker check-in.
DD/MM/YYYY --:--			Removal for forensic duplication.