Forensic Evidence Acquisition & Analysis Concepts

Order of Volatility & Persistent Storage

• Persistent storage types include DVDs, Blu-rays, and thumb drives. These are at the lower end of the order of volatility, meaning data stored on them is less volatile and persists longer compared to more volatile forms like RAM.

Chain of Custody

• Chain of custody is a critical aspect in forensic investigations, ensuring the integrity and admissibility of evidence.

Digital Evidence Paradigm

• The digital evidence paradigm outlines the process for handling digital evidence at a crime scene:

  • Identify Sources: Pinpointing where digital evidence might reside.

  • Seize: Taking possession of the identified digital evidence.

  • Transport: Safely moving the seized evidence to a forensic lab or acquisition site.

  • Acquisition: Obtaining a forensically sound copy of the evidence. This can be one of two types:

    • Live Acquisition: Acquiring data from a running system.

    • Dead Acquisition: Acquiring data from a powered-off system or storage device.

Fileless Malware & RAM Acquisition Implications

• Definition: A fileless malware is a malicious application or binary that operates without touching the file system. It resides exclusively in RAM (Random Access Memory).

• Execution & Impact: While in RAM, it can execute, create process memory, and perform malicious activities such as credential dumping (e.g., using Mimikatz) and exfiltrating data.

• Forensic Challenge: If RAM is not captured, the compromise by fileless malware may go undetected, as there would be no traces on the hard drive or file system. Therefore, performing a RAM acquisition is crucial to identify indicators of compromise (IoCs) or the attack vector.

• Malware Evasion: Some advanced malware can detect sequential access of RAM (which occurs during memory imaging, as RAM is designed for random access) and can