Incident Response and Management · Topic 5 of 6
Evidence Handling and Forensics
Preserve digital evidence for CySA+: order of volatility, chain of custody, forensic imaging with hashes, write blockers and legal hold during containment.
- 5 min
- Includes a diagram
- Collect the most volatile evidence first, with memory before disk.
- Isolating a host preserves volatile data, while powering off destroys it.
- The chain of custody records who handled evidence, when and why.
What it is
Digital forensics is the careful collection and examination of data from computers, networks and cloud services to find out what happened. Evidence handling is the set of rules that keeps that data trustworthy.
If evidence is altered, lost or poorly documented, the findings can be doubted, and they may be unusable in a disciplinary or legal process. Analysts do not need to be forensic experts, but they must avoid damaging evidence before the specialists arrive.
How it works
Order of volatility
Some data disappears quickly, so collect the most volatile items first. A common order, from most to least volatile, follows the guidance in Request for Comments (RFC) 3227, which covers evidence collection and archiving:
| Order | Data | Why it matters |
|---|---|---|
| 1 | Processor registers and cache | Lost almost at once |
| 2 | Routing tables, Address Resolution Protocol (ARP) cache, process table, memory | Lost at shutdown or reboot |
| 3 | Temporary file systems (temp files, swap space) | May be overwritten or cleared |
| 4 | Disk contents | Persistent, but can be changed by use |
| 5 | Remote logging and monitoring data | Held elsewhere, but may roll over |
| 6 | Physical configuration and network topology | Changes slowly |
| 7 | Archival media and backups | Most stable |
In practice, capturing memory and volatile network information before powering anything down is the key lesson.
Containment versus preservation
Containment and evidence preservation can pull in different directions. Isolating a host from the network usually keeps memory and running processes intact, which suits both goals. Powering off or reimaging removes volatile evidence, so only do it once the needed data is captured, or when the risk of spread is greater.
Chain of custody
The chain of custody is a written record of every person who handled the evidence, with dates, times, locations and reasons. It shows that the evidence has been controlled and unchanged since collection.
A custody entry usually records:
- A unique evidence identifier and description (for example, serial number of a disk).
- Who collected it, when and where.
- Each transfer: from whom, to whom, when and why.
- How and where it is stored, such as a locked, access controlled location.
A gap in the chain weakens the value of the evidence.
Forensic imaging and hashing
Analysts do not work on the original. They make a forensic image, which is a bit for bit copy of a drive or memory, and examine the copy.
- A write blocker lets a device be read but prevents any change, so connecting the original drive does not alter it.
- A hash such as Secure Hash Algorithm 256 (SHA-256) is computed on the original and on the image. Matching values show that the copy is exact, and the hash is recorded in the notes.
- The original is sealed and stored. All analysis runs on verified copies.
Original drive hash: 9c1f...e2a7
Image file hash: 9c1f...e2a7 (match, copy verified)A change of even one bit produces a different hash, which is why hashing proves integrity. Hash values here are shortened for display.
Other evidence sources
- Memory dumps reveal running processes, network connections and sometimes keys or passwords in memory.
- Logs from servers, firewalls, proxies and cloud services, preserved in full and in their original form.
- Network captures and flow records.
- Email and chat records, collected within legal and policy limits.
- Cloud and virtual machine snapshots, which are quick ways to preserve a running instance.
- Mobile devices, which may need special handling.
Record the system time and any time offset when collecting, since timeline accuracy depends on it.
Legal hold and admissibility
A legal hold (also called a preservation order) tells the organisation to keep relevant data and stop routine deletion. It applies when litigation or investigation is expected.
Evidence is more likely to be accepted when it was collected lawfully, with authority, documented and handled with an intact chain of custody. Involve the legal team early, especially for privacy rules and for evidence from employees' devices.
Working practices
- Document every action, with times, in a notebook or case system.
- Use trusted tools and note their versions.
- Minimise changes to the live system, and record any that were unavoidable.
- Keep the original sealed, and work on copies.
- Store evidence securely with limited access.
Do not boot a suspect drive, run tools from it, or browse files on the original system. Even reading files can change timestamps and overwrite evidence.
What to remember for the exam
- Collect the most volatile evidence first, with memory before disk.
- Isolating a host preserves volatile data, while powering off destroys it.
- The chain of custody records who handled evidence, when and why.
- A forensic image is a bit for bit copy, and analysis is done on the copy.
- Matching hash values prove the copy matches the original.
- A write blocker prevents changes when reading a drive.
- A legal hold stops routine deletion of relevant data.
- Document actions and time offsets to keep the evidence defensible.
- Involve legal early when a case may go to court or disciplinary action.
Common mistakes
Rebooting to clean up. A restart erases memory and running state before they are captured.
Analysing the original drive. Any use of the original risks changing it, so use a verified image.
Poor custody records. Without a complete log, an opposing party can question the evidence.
Forgetting cloud and remote logs. Data in the cloud or on a log server can roll over, so request or export it quickly.
Assuming a hash proves who did something. A hash proves integrity of data, not the identity of an actor.
Check yourself
What does the order of volatility tell an analyst to do?
Collect the most short lived data, such as memory, before more durable data such as disks.
Why are hashes calculated for a forensic image?
Matching hashes of the original and the copy prove the copy is exact and unaltered.
What is recorded in a chain of custody?
Each person who handled the evidence, with dates, times, locations and the reason for each transfer.
Topic 5 of 6 in Incident Response and Management
Test yourself on Incident Response and Management
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.