NIST SP 800-86 Digital Forensics

What it is

NIST SP 800-86 is a guide to using forensic techniques during incident response, so that evidence is collected and kept in a sound way.

Evidence is easy to damage. Powering off a machine, copying files carelessly or working on the original disk can all destroy or change what you need.

The guide describes a process of collection, examination, analysis and reporting. This page covers the collection concepts the exam names.

How it works

Collect the most fragile data first, prove that it was not altered, and keep it safe.

Evidence collection order

Different data lives for different lengths of time. The order of volatility says to collect the data that disappears fastest first.

The guide also asks you to consider the value of data, how much effort it takes to collect and how likely it is to be lost. Start with the data that is most volatile and most valuable.

Volatile data collection

Volatile data is lost when a system loses power or is restarted. It can hold the best evidence of an attack in progress, such as malware that exists only in memory.

Items to collect from a live system include:

• A memory image
• Running processes and open files
• Network connections and listening ports
• Logged in users
• The ARP cache and routing table
• The system time and time zone

$ date
$ who
$ ps aux
$ ss -tulnp
$ ip neigh

These Linux commands show the time, logged in users, processes, network sockets and the neighbour cache. On Windows, tasklist, netstat -ano and arp -a give similar facts.

Collecting from a live system changes the system a little, because running a tool uses memory and leaves traces. Use trusted tools from external media, keep notes of every command and record the time. Write the output to a separate device, not to the system under investigation.

Data integrity

Data integrity means proving that the evidence is the same as when it was collected. A hash is used for this.

The analyst takes a hash of the evidence at collection, and again later. If the values match, the data is unchanged.

$ sha256sum disk_image.dd

Other integrity practices help.

• Use a write blocker when connecting a disk, so that the analysis machine cannot write to it.
• Make a bit for bit forensic image of the disk and work on a copy of the image, not on the original.
• Record the hash of the image and of every copy.

Data preservation

Data preservation keeps evidence safe and usable until it is needed.

• Store the original and the copies in a secure location with limited access.
• Keep a chain of custody record of who handled each item and when.
• Label each item and record where it came from.
• Keep evidence for as long as policy or the law requires.
• Protect it from damage, such as heat and magnetic fields, and from tampering.

If the situation allows, take the system off the network to stop further change. Do not shut it down first, since that loses volatile data. The decision depends on the case, and the guidance of the incident handler applies.

Reporting

The final step is a report. It states what was collected, how, and what was found. It should be clear enough for a non technical reader and supported by the records of hashes and custody.