Security Operations · Topic 13 of 13
Digital Forensics and Data Sources
Security+ digital forensics and investigation data: legal hold, chain of custody, order of volatility, log sources, metadata and packet captures.
- 4 min
- Legal hold means keep the data. Chain of custody records who handled the evidence.
- Collect the most volatile data first, starting with memory.
- Work on a verified copy and use hashes to show that the evidence has not changed.
What it is
Digital forensics is the careful collection and examination of digital evidence so that it can be trusted, and possibly used in court. An investigation also depends on the right data sources, such as logs and packet captures.
This page joins the two: how to handle evidence properly, and where the facts come from.
How it works
Forensic concepts
| Concept | Meaning |
|---|---|
| Legal hold | An order to keep relevant data and not delete it |
| Chain of custody | A record of who handled the evidence, when and why, from collection onward |
| Acquisition | Collecting evidence, often by making a verified copy |
| Preservation | Keeping evidence unchanged and secure |
| Reporting | Documenting what was found and how |
| E-discovery | Finding and producing electronic information for legal matters |
A broken chain of custody can make evidence unreliable. Analysts typically work on a copy and use a hash of the original and the copy to show that the data did not change.
Order of volatility
Data that disappears fastest should be collected first. The usual order, from most to least volatile, is shown below.
| Order | Data |
|---|---|
| 1 | Central processing unit (CPU) registers and cache |
| 2 | Memory (RAM), including running processes, network connections and routing and Address Resolution Protocol (ARP) tables |
| 3 | Swap or page file and temporary files |
| 4 | Disk contents |
| 5 | Remote logs and monitoring data |
| 6 | Backups and archived media |
Pulling the power cord loses what is in memory, so decide what to collect before shutting a system down.
Log data
Logs record what systems did and are the most common source.
| Source | What it shows |
|---|---|
| Firewall logs | Allowed and blocked connections |
| Application logs | Application events, errors and user actions |
| Endpoint logs | Activity on a device |
| Operating system security logs | Logins, privilege use and policy changes |
| Intrusion detection system (IDS) and intrusion prevention system (IPS) logs | Detected attacks and signatures that matched |
| Network logs | Traffic from switches, routers and proxies |
| Metadata | Data about data, such as file author, creation time or email headers |
Correlating several logs gives a fuller story. A firewall log may show a connection, the operating system log may show the login that followed, and an application log may show what the user did.
Other data sources
| Source | Use |
|---|---|
| Vulnerability scans | Show weaknesses that may explain how an attacker got in |
| Automated reports | Regular summaries of activity and events |
| Dashboards | Live view of key measures from a security information and event management (SIEM) system or monitoring tool |
| Packet captures | Full copies of network traffic, including content, for detailed analysis |
A packet capture shows the content of traffic, while NetFlow shows only summaries. Packet captures can be large, so they are often kept for short periods or taken only when needed.
Time and integrity
Logs must have accurate and consistent time stamps to be placed in order. Protect logs from change by sending them to a central store with restricted access.
What to remember for the exam
- Legal hold means keep the data. Chain of custody records who handled the evidence.
- Collect the most volatile data first, starting with memory.
- Work on a verified copy and use hashes to show that the evidence has not changed.
- Log sources include firewall, application, endpoint, OS, IDS/IPS and network logs.
- Metadata describes data and can reveal when and by whom it was created.
- Packet captures hold the actual content. NetFlow holds summaries.
- Dashboards and automated reports support monitoring and investigation.
- Accurate time and protected central logs make evidence reliable.
When a question asks what to do first with a running compromised machine, think about the order of volatility and capturing memory before shutdown.
Common mistakes
Breaking the chain of custody. Undocumented handling raises doubt about whether evidence was altered.
Investigating on the original disk. Examine a verified copy so the original remains unchanged.
Confusing legal hold with backup. A hold stops deletion of relevant data. A backup is a recovery copy.
Relying on one log source. One log shows only part of the picture.
Forgetting about time zones. Logs from systems in different zones or with wrong clocks give a wrong sequence.
Deleting or reimaging a system before evidence is collected can destroy the proof and make the incident impossible to understand.
Check yourself
What does chain of custody record?
Who handled the evidence, when and why, from the time it was collected.
Which data should be collected first according to the order of volatility?
The most volatile data, such as CPU cache and memory, before disk contents and backups.
What is the difference between a packet capture and NetFlow?
A packet capture keeps full traffic including content, while NetFlow keeps only summary information about each flow.
Topic 13 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.