Legal Holds + Acquiring Forensic Data + Validating Forensic Data Integrity

A legal hold or litigation hold

is a notice that informs an organization that they must preserve data and records that might be destroyed or modified in the course of their normal operations

Discovery processes

allow each side of a legal case to obtain evidence from each other and other parties involved in the case

The order of volatility documents

what data is most likely to be lost due to system operations or normal processes

Common forensic locations include the following

• CPU cache and registers

• Ephermal data such as the process table, kernel statistics, the system’s ARP cahce, and similar information

• RAM

• Swap and pagefile information

• Files and data on disk

• Operating system

• Devices such as smartphones, tablets, IoT devices, and embedded or specialized systems

• Firmware

• Snapshots from VMs

• Network traffic and logs

• Artifacts like devices, printouts, media, and other items related to investigations

It is important

to maintain chain-of-custody documentation if the forensic case may result in a legal case

In cloud environments, you will often have to consider

• Right-to-audit clauses

• Regulatory and jurisdiction concerns

• Data breach notification laws

Validating Forensic Data Integrity

• Create a hash

• Documenting the provenance or where an image or drive came from and what happened with it