4.8c digital forensics

Digital forensics

The formal process of collecting, preserving, and analyzing data from a security event, used both to understand what happened and to support potential legal proceedings.

RFC 3227

Guidelines for Evidence Collection and Archiving, the industry best-practice reference for digital forensics.

Legal hold

A formal request, typically from a lawyer, specifying what data must be preserved and made available; sent to the data custodian.

Data custodian

The person or role responsible for evaluating a legal hold and managing acquisition of the requested data.

ESI (Electronically Stored Information)

Digital data held in a separate repository specifically for legal hold purposes.

Data format conversion (legal hold)

Proprietary data formats sometimes need conversion into a standard, usable form before being stored for legal purposes.

Pristine/unmodified data integrity

The core forensic requirement: collected data must remain unchanged throughout the investigation.

Chain of custody (digital)

Documentation of who accessed evidence and when, using hashes and digital signatures to prove data integrity; the digital equivalent of a sealed evidence bag.

Chain of custody mechanism

Secured using the same hashing/digital signature technique seen in code signing and email security: hash at collection, re-verify on each access to prove nothing changed.

Data acquisition sources

Disk, memory, firmware, file system, network devices, firewall logs, VM snapshots; evidence can come from many different locations.

Non-obvious evidence sources

Log files, recycle bin, temporary storage, browser bookmarks, saved logins; often overlooked but valuable.

Forensic reporting components

Summary/overview, detailed acquisition documentation, analysis (factual data description), and conclusion (interpretation of what happened).

Working from copies

Analysis is performed on copies of original evidence, never the original itself, preserving the source and providing a backup.

Remote wipe risk (mobile forensics)

Mobile devices can be remotely erased, making it critical to copy data immediately and work from copies rather than the live device.

Live data acquisition

Collecting data while a system is still running, especially important for encrypted systems that lock down automatically on power-off.

E-discovery

The process of collecting, preparing, reviewing, interpreting, and producing electronic documents or data; acquisition only, with no analysis requirement.

E-discovery vs forensics

E-discovery is purely about gathering and handing over data, e.g. imaging a drive. Formal forensic analysis, interpreting and recovering deleted data, is a separate, subsequent process.