Security Operations · Topic 1 of 9
Investigations and Forensics
Evidence collection and handling, chain of custody, order of volatility, admissibility, digital forensic tools and techniques, and investigative reporting.
- 3 min
- Includes a diagram
- Evidence must be relevant, reliable, material and lawfully obtained.
- Chain of custody documents every handler and transfer.
- Collect by order of volatility; memory before disk.
What it is
Investigations find out what happened, who was involved and how, often with the possibility of legal action. Evidence must be collected and handled so it is reliable and admissible. Mistakes in the first minutes can make evidence unusable.
How it works
Evidence types and admissibility
| Type | Example |
|---|---|
| Real | Physical items such as a laptop |
| Documentary | Logs, emails, records |
| Testimonial | Witness statements |
| Demonstrative | Charts or models that explain other evidence |
For evidence to be admissible it must be relevant, reliable (unaltered, proven by hashes and custody records), material to the case and lawfully obtained. Logs created automatically in routine operations can qualify as business records, an exception to the hearsay rule.
Chain of custody
Document who collected each item, when, where it was stored and every transfer. A break in the chain lets the other side argue the evidence was altered.
Order of volatility
Collect the most volatile evidence first:
- CPU registers and cache
- Memory (RAM), including running processes and network connections
- Temporary file systems and swap
- Disk storage
- Remote logs and monitoring data
- Archives and backups
Pulling the plug destroys memory, which may hold encryption keys, malware and connections. If a full-disk-encrypted laptop is running and unlocked, capture memory first, then image the unlocked volume.
Forensic practice
- Work on bit-for-bit copies, never the original.
- Use write blockers when imaging drives.
- Hash originals and copies (for example SHA-256) to prove they match.
- Use validated tools and document every step so another examiner could repeat it.
- In cloud environments without physical access, use provider tools to snapshot disks and capture memory, then hash the copies.
Digital forensics areas
Media analysis (disks), memory analysis, network analysis (packet captures, flows), software analysis (malware, code) and mobile device analysis.
Investigative techniques
Interviews and interrogations (by trained staff and with legal advice), surveillance where lawful, analysis of logs and artifacts, and timeline reconstruction.
Reporting and documentation
The report states facts, methods, findings and limitations in language that non-technical readers, including courts, can follow. Keep opinions separate from facts.
Law enforcement and legal counsel
Decisions to involve law enforcement belong to executive management advised by legal counsel, because they bring legal, financial and reputational consequences. Involve counsel early when litigation is possible.
How the exam asks about this
- "Running laptop with an unlocked encrypted volume; admissible disk evidence needed." Capture memory, then image the unlocked volume.
- "Opposing counsel calls firewall logs hearsay." They were created automatically in routine operations: business records.
- "Who decides whether to call law enforcement?" Executive management with legal counsel.
What to remember for the exam
- Evidence must be relevant, reliable, material and lawfully obtained.
- Chain of custody documents every handler and transfer.
- Collect by order of volatility; memory before disk.
- Work on hashed copies with write blockers.
- Management and counsel decide on law enforcement.
Do not alert a suspected insider before evidence is preserved. Confronting them early risks destruction of evidence.
Common mistakes
Shutting down a running system before capturing memory.
Analyzing the original drive instead of a verified copy.
Letting technical staff decide on law enforcement involvement.
Check yourself
What is collected first under the order of volatility?
The most volatile data: CPU registers and cache, then memory.
How do you prove a forensic image matches the original?
Compare cryptographic hashes of the original and the copy.
What makes routine logs admissible despite hearsay objections?
They are business records created automatically in the normal course of business.
Topic 1 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.