Lesson 12 - Group 2: Digital Forensics

Digital forensics

Collecting and analyzing evidence from computer systems to a standard that may be accepted in court.

Due process

Evidence-collection and analysis procedures designed to ensure fairness.

Legal hold

Authority or requirement to preserve and potentially seize systems or information as evidence.

Order of volatility

Collecting the most temporary and easily lost evidence before less volatile evidence.

What is the evidence order shown in Lesson 12?

CPU registers and cache, RAM, persistent storage, remote logs and monitoring data, physical configuration and network topology, and archival media.

System memory acquisition

Collecting evidence from nonpersistent memory, including temporary filesystems, registry data, network connections, and cryptographic keys.

Why must volatile memory normally be collected while a system is running?

Its contents can be lost when the system is powered off.

Disk image acquisition

Creating a forensic image of nonvolatile storage media or devices.

Live versus static disk acquisition

Live acquisition images a running system; static acquisition occurs after shutting down the host or disconnecting power.

Write blocker

A control that prevents changes from being written to evidence media during acquisition or analysis.

Why are cryptographic hashes used in forensics?

To verify evidence integrity and demonstrate that the source, forensic image, and analysis copy have not changed.

What evidence items should be hashed?

The source device, the reference image, and the copy used for analysis.

Chain of custody

Documentation of evidence possession, transfer, handling, analysis, storage, and presentation.

What physical controls support evidence preservation?

Tamper-evident packaging, secure storage, and protection from environmental hazards.

What principles should guide forensic reporting?

The analysis should be unbiased, repeatable, and should not alter or manipulate evidence.

E-discovery

Identifying, preserving, searching, tagging, deduplicating, and disclosing electronically stored information.

ESI

Electronically Stored Informatio