Incident Response · Topic 3 of 4
Forensics Investigation and Business Continuity Basics
Learn the forensics investigation process, evidence handling and business continuity and disaster recovery basics, with BIA, RTO and RPO, for CND 312-38.
- 5 min
- Collect volatile evidence first, use a write blocker and work on a copy.
- Hash values prove integrity, and chain of custody proves handling.
- BIA sets the RTO and RPO, and the RTO must fit within the MTD.
What it is
Digital forensics is the process of collecting, preserving, examining and reporting on digital evidence so that it can be trusted and, if needed, used in court or a disciplinary hearing.
Business continuity (BC) keeps critical business functions running during and after a disruption. Disaster recovery (DR) is the part that restores IT systems and data. A defender uses forensics to learn what happened, and BC/DR to keep the organization alive while it does.
How it works
The forensics investigation process
NIST SP 800-86 describes four phases. A fuller process adds preparation up front.
| Phase | What happens |
|---|---|
| Preparation | Authority, tools, trained staff, forensic workstation and legal approval ready |
| Identification and collection | Find sources of evidence, then acquire it with care |
| Examination | Extract relevant data from what was collected |
| Analysis | Interpret the data to answer who, what, when, where and how |
| Reporting | Present findings clearly, with the method used |
Principles that protect evidence:
- Collect volatile data first (memory, running processes, network connections), then disk data.
- Use a write blocker when imaging a drive so the original is not changed.
- Create a forensic image (a bit by bit copy), compute a hash (such as SHA-256) of the original and the copy, and compare them to prove they match.
- Analyze the copy, never the original.
- Keep a chain of custody: a record of who held the evidence, when, and why.
- Document every action. Only trained people should handle the evidence.
- Respect law and policy, including privacy rules and search authority.
| Evidence source | Examples |
|---|---|
| Memory | Processes, network connections, encryption keys |
| Disk | Files, deleted data, system artifacts |
| Network | Packet captures, flow records |
| Logs | System, application, firewall and cloud logs |
| Mobile and cloud | Phone data, cloud account records |
Tools do specific jobs, for example disk imaging, memory capture, file system analysis and timeline building. The exam asks about the purpose, not the product.
Introduction to business continuity and disaster recovery
| Term | Meaning |
|---|---|
| Business continuity | Keeping essential business functions going through a disruption |
| Disaster recovery | Restoring IT infrastructure and data after a disaster |
| Business impact analysis (BIA) | Finds critical functions and the effect of losing them over time |
| Maximum tolerable downtime (MTD) | The longest a function can be down before the damage is unacceptable |
| Recovery time objective (RTO) | Target time to restore a system, which must be shorter than MTD |
| Recovery point objective (RPO) | The maximum acceptable data loss measured in time |
Example: an RPO of one hour means backups or replication must run at least hourly. An RTO of four hours means the system must be back within four hours.
Disasters include natural events, fire, power loss, cyberattacks such as ransomware, hardware failure, and human error.
BC/DR activities
The program runs as a cycle.
- Governance: policy, management support and an owner.
- Risk assessment: identify threats to critical functions.
- Business impact analysis: rank functions and set RTO and RPO.
- Strategy: choose recovery methods for people, sites, systems and data.
- Plan development: write the continuity and recovery plans.
- Testing and training: exercise the plans and train staff.
- Maintenance: update after changes and after every test or incident.
Recovery strategies for data and sites:
| Backup type | What is copied | Restore |
|---|---|---|
| Full | Everything | One set, fastest restore |
| Incremental | Changes since the last backup of any type | Needs the full plus every incremental |
| Differential | Changes since the last full backup | Needs the full plus the latest differential |
| Alternate site | State | Recovery time |
|---|---|---|
| Hot site | Fully equipped and running, with current data | Minutes to hours |
| Warm site | Equipment ready, data restored when needed | Hours to days |
| Cold site | Space and power only | Days to weeks |
Follow the 3-2-1 backup rule: three copies, on two kinds of media, with one copy offsite. Keep one copy offline or immutable so ransomware cannot encrypt it, and test restores.
A worked example
A hospital finds that its patient records system must be back within two hours and may lose no more than 15 minutes of data. The BIA sets RTO at two hours and RPO at 15 minutes.
Nightly backups cannot meet that RPO. The team chooses continuous replication to a hot site and tests a failover every quarter.
How the exam asks about this
- "Which measure defines the maximum acceptable data loss in time?" → Recovery point objective (RPO).
- "Which alternate site is fully equipped and ready within minutes?" → A hot site.
- "Which step proves a forensic copy matches the original?" → Comparing hash values.
What to remember for the exam
- Collect volatile evidence first, use a write blocker and work on a copy.
- Hash values prove integrity, and chain of custody proves handling.
- BIA sets the RTO and RPO, and the RTO must fit within the MTD.
- Hot sites recover fastest, cold sites slowest.
- Incremental backups restore slowly, differential backups restore with two sets.
Using the original disk for analysis can change timestamps and ruin the evidence. Image first and work on the copy.
Common mistakes
Mixing up RTO and RPO. RTO is about time to restore, RPO is about how much data you can lose.
Skipping testing. An untested plan often fails when needed.
Treating BC and DR as the same. BC covers the whole business, DR covers IT recovery.
Check yourself
Why is a write blocker used?
To prevent any change to the original drive while it is copied.
What does the BIA produce?
A ranking of critical functions with their downtime impact, which sets the RTO and RPO.
What is the 3-2-1 backup rule?
Three copies on two types of media with one stored offsite.
Topic 3 of 4 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.