7.1 Investigations & Digital Forensics
7.1 Investigations & Digital Forensics
When a security incident, policy violation, fraud allegation or other suspicious event occurs, the organisation needs to determine what happened without destroying the evidence needed to answer that question.
Digital forensics provides structured methods for identifying, preserving, collecting, examining, analysing and reporting digital evidence.
Preserve
Protect evidence from unnecessary alteration, loss or contamination.
KEEP IT TRUSTWORTHYInvestigate
Examine artifacts and reconstruct relevant activity.
WHAT HAPPENED?Document
Record methods, evidence, custody, findings and limitations.
CAN WE SUPPORT IT?Understand and Comply With Investigations
Identify, preserve, acquire, protect and track relevant evidence.
Maintain clear records showing what was done, what was found and how conclusions were reached.
Use appropriate methods to reconstruct events and understand relevant activity.
Use suitable and validated forensic capabilities according to established procedures.
Analyse evidence from data, computers, networks, mobile devices and related digital environments.
7.1 Official Topics
The Big Idea
Investigation is not simply searching a computer until something suspicious appears.
The investigator must consider authority, evidence integrity, reproducibility, documentation and the purpose of the investigation.
Investigation Flow
Investigative Authority
Investigators should understand what authority permits the investigation and what limitations apply before accessing systems or information.
Internal policy, employment agreements and authorised investigation procedures may govern internal investigations.
Laws, court processes and investigative powers may govern civil or criminal investigations.
Regulators may impose investigation, preservation or reporting obligations.
Third-party systems may require contractual rights or provider cooperation.
Access to communications and personal information may be restricted even during legitimate security investigations.
Requirements may differ according to location and applicable law.
⚖️ Investigation Context Matters Different investigations can have different requirements
Domain 1 introduces several investigation types. Domain 7 focuses more strongly on how security operations support those investigations.
Internal policy, employee misconduct or organisational procedures.
Disputes between parties where electronically stored information may become relevant.
Potential criminal activity requiring particularly careful coordination with appropriate legal and investigative authorities.
Investigation conducted under regulatory obligations or oversight.
Investigations arising from standards, contracts or sector requirements.
Authority, privacy, reporting, retention and evidence requirements can depend on the investigation's purpose and jurisdiction.
What Is Digital Forensics?
Digital forensics applies investigative and computer-science methods to digital evidence while preserving the integrity of the information and maintaining appropriate evidence-handling records.
Determine where potentially relevant evidence may exist.
Acquire relevant information using suitable procedures.
Extract, recover, filter and organise relevant digital artifacts.
Interpret artifacts and reconstruct events.
Explain methods, evidence, findings, limitations and conclusions.
🧠 Examination vs Analysis Extracting evidence is different from interpreting it
Identify and extract potentially relevant information from the evidence.
Recover browser history and authentication logs.
Interpret that information to determine what it means in the context of the investigation.
Correlate browser activity with authentication events to reconstruct the attacker's actions.
Examine vs Analyse
Evidence Collection & Handling
Digital evidence can be altered extremely easily.
Collection procedures therefore aim to preserve the integrity, provenance and context of the information being investigated.
Chain of Custody
Chain of custody records the movement and handling of evidence throughout its lifecycle.
It helps demonstrate:
who possessed the evidence, when they possessed it, why it was transferred and what happened while it was under their control.
Unique identifier for the item.
What exactly was collected?
Who collected it?
Where was it obtained?
When was it collected or transferred?
Who gave it to whom?
Why was possession transferred?
Where was the item safeguarded?
Chain of Custody
🔗 Broken Chain of Custody Unexplained possession can undermine confidence in evidence
A laptop is collected at 10:00.
The evidence record shows:
Investigator A → evidence storage.
Three days later, Investigator B analyses it.
Nobody recorded:
when B received it or who removed it from storage.
Hashing & Evidence Integrity
Cryptographic hashes are commonly used to help demonstrate that digital evidence has not changed between acquisition and later examination.
Before analysing the evidence copy, the examiner recalculates the hash.
If the expected and calculated values match, this provides evidence that the copy has remained unchanged.
#️⃣ A Hash Does Not Replace Chain of Custody They answer different questions
Helps answer:
"Is this data unchanged from the reference value?"
Helps answer:
"Who controlled this evidence throughout its lifecycle?"
Preserve the Original
Where practical and appropriate, forensic examination is performed using a verified working copy rather than repeatedly modifying or interacting with original evidence.
Evidence Rule
💽 Forensic Imaging Acquire evidence while preserving its original content
Acquires the underlying storage content at a low level and may include areas not visible through normal filesystem access.
Collects selected files, objects or data available through a filesystem, application, operating system or service interface.
Device type, encryption, system state, authority, available tools, business impact and investigation objectives all affect the appropriate method.
Write Blockers
A write blocker is used during appropriate storage-media acquisition to prevent or restrict writes to the source evidence.
Physical device positioned between forensic workstation and source media.
Software-based mechanism used to prevent changes to evidence media.
Live vs Offline Acquisition
Collect evidence while the system is operating.
ADVANTAGE: VOLATILE DATA
Acquire persistent storage after the system is no longer actively operating.
ADVANTAGE: LESS LIVE-SYSTEM CHANGE
Running forensic tools on a live machine inevitably changes some system state, but shutting the machine down may destroy volatile evidence.
💨 Order of Volatility Some digital evidence disappears much faster than other evidence
When volatile evidence is important, investigators generally consider collecting the most transient information before more persistent sources.
Safety, business impact, encryption, authority, available tools and evidential value can affect the actual decision.
Volatility
🧠 Memory Forensics RAM can reveal evidence that never reaches disk
Possible Memory Artifacts
A ransomware process is currently executing entirely in memory.
Powering off the workstation before collecting volatile evidence may destroy some of the most useful investigative information.
⏻ Do Not Automatically Power Off a System The correct action depends on investigative and operational priorities
Immediate shutdown may:
- destroy volatile memory evidence;
- terminate active network sessions;
- lose running-process information;
- remove access to decrypted data.
Leaving the system running may:
- allow an attacker to continue operating;
- allow malware to continue modifying data;
- create additional system changes;
- increase business or safety impact.
Evidence Must Survive the Investigation
Evidence preservation means maintaining digital evidence in a condition that supports reliable later examination and analysis.
Avoid unnecessary changes to original evidence.
Use integrity verification where appropriate.
Limit handling to authorised personnel.
Preserve timestamps, attributes and relevant context.
Safeguard physical and digital evidence repositories.
Apply applicable investigative, organisational and legal retention requirements.
🔬 Forensically Sound Methods The method should support confidence in the evidence and conclusions
Record what procedures were performed.
Another competent examiner should be able to understand and, where appropriate, repeat the technique.
Use suitable techniques and tools with understood limitations.
Minimise unnecessary alteration of evidence.
Connect findings back to supporting evidence.
Operate within the investigation's legal and organisational scope.
Investigative Techniques
Investigators combine multiple techniques to reconstruct relevant activity.
Arrange events chronologically to understand what happened before, during and after an incident.
Compare events from multiple systems to identify relationships.
Examine timestamps, ownership, attributes and other information about digital objects.
Locate relevant strings, identifiers, addresses or known patterns.
Identify recoverable information no longer visible through normal application interfaces.
Recover files or fragments using identifiable structures when normal filesystem metadata is unavailable.
Examine volatile system state.
Examine packets, flows and network-service records.
Combine artifacts into a defensible explanation of relevant events.
🕒 Timeline Analysis One artifact gives a clue; several correlated artifacts tell a story
⏱️ Time Matters Poor time information can make correlation difficult
Consider
Firewall event: 14:00 UTC.
Application event: 15:00 BST.
These may describe:
the same moment.
Correlate Multiple Evidence Sources
Identity log says: User A authenticated at 02:14.
Digital Artifacts
A digital artifact is information created, stored or transmitted by digital activity that may become relevant to an investigation.
An attacker authenticates to a server.
The action may leave artifacts in:
🧩 Artifact vs Indicator of Compromise Not every artifact means an attack occurred
A digital trace or object relevant to analysis.
Browser-history entry.
Evidence or observable information suggesting that malicious activity may have occurred.
Known malicious command-and-control address appearing in network logs.
Data Artifacts
Documents, images, archives, executables and other stored objects.
Creation times, modification times, ownership and object attributes.
Application records, transaction history and structured information.
Messages, headers, attachments and routing information.
Authentication, transactions, errors and user actions.
Files, versions, snapshots and service-generated records.
Computer Artifacts
An attacker downloads malware.
Possible evidence may include:
Network Artifacts
Detailed network communications where capture exists.
Metadata describing communicating endpoints and traffic patterns.
Name-resolution activity.
Evidence connecting devices with dynamically assigned addresses.
Allowed and blocked network connections.
Web requests, destinations and user activity.
Remote sessions and identity-related connection evidence.
Security detections and associated network information.
Network Forensics
🌐 Packets vs Flow Data Detail versus summary
May contain detailed packet-level communication information.
DEEP DETAIL
Summarise communication relationships without necessarily retaining full packet payloads.
CONNECTION SUMMARY
Mobile Device Artifacts
Device locking, encryption, remote-wipe capability, cloud synchronisation and rapidly changing mobile platforms can affect acquisition and preservation decisions.
📱 Mobile Device Preservation Connectivity can affect evidence
Depending on circumstances, investigators may need to consider whether network connectivity could:
- allow remote wiping;
- cause new messages or synchronisation events;
- change device state;
- permit remote access.
Cloud Forensics
Evidence in cloud environments may be distributed across provider and customer systems rather than existing on a single physical computer.
Administrative and API actions performed against cloud resources.
Authentication and authorization events.
Evidence created by individual cloud services.
Point-in-time copies of relevant cloud resources where supported.
Previous versions of cloud-hosted data where versioning exists.
Some required information may be controlled by the cloud provider.
☁️ Cloud Forensic Challenges Forensic readiness becomes especially important in distributed environments
A compromised virtual server is automatically destroyed by an orchestration platform.
Without adequate external logging or snapshots:
important evidence may disappear with the workload.
Cloud Forensics
Forensic Readiness
Forensic readiness means designing systems and processes so useful evidence can be identified and collected effectively when an investigation occurs.
Generate evidence before an incident occurs.
Keep relevant evidence for an appropriate period.
Make event correlation possible.
Enable required audit and control-plane logging.
Ensure investigators can obtain necessary evidence when authorised.
Prepare forensic capabilities before they are urgently required.
Define roles, escalation and evidence-handling processes.
Understand how evidence will be obtained from external providers.
Digital Forensics Tools, Tactics & Procedures
Different evidence sources require different forensic capabilities.
Create forensic images or collect relevant data.
Protect source media during appropriate acquisition.
Acquire volatile memory from running systems.
Examine files, metadata and deleted information.
Analyse packets, flows and network-service records.
Extract and examine evidence from mobile devices.
Aggregate timestamps and events for reconstruction.
Export logs, snapshots and service evidence through supported interfaces.
🧰 Forensic Tools Need Trust A tool's output should not be accepted blindly
Understand
A forensic program reports:
"File created at 14:03."
Before relying on this conclusion, the examiner should understand:
- which timestamp the tool displayed;
- how that filesystem records time;
- whether the timestamp can be changed by copying or restoring;
- which time zone was applied.
Artifacts Require Interpretation
A digital artifact may demonstrate that something exists without proving exactly how or why it was created.
A suspicious file exists in a user's Downloads folder.
"The user intentionally downloaded and executed malware."
Further evidence may be required to determine:
🧠 Fact vs Inference Separate what the evidence shows from what you conclude from it
Authentication logs show Account A successfully authenticated at 03:12.
Account A's credentials were used at 03:12.
The human owner of Account A personally performed the login.
🕵️ Be Careful With Attribution Technical evidence can support attribution without necessarily proving identity by itself
Malicious traffic originates from:
IP address X.
This may establish:
where the observed traffic came from.
It does not automatically prove:
who controlled the system generating that traffic.
Reporting & Documentation
Documentation creates the record that allows another person to understand what the investigator did and how conclusions were reached.
Investigation identifier, objective and scope.
Relevant authorisation and restrictions.
What evidence was collected?
Who handled the evidence?
Which acquisition and examination methods were used?
Which forensic tools generated the results?
Relevant hashes or other integrity records.
What significant events occurred?
What does the evidence demonstrate?
What could not be determined?
What is the evidence-supported outcome?
📝 Contemporaneous Notes Record important actions while the investigation is occurring
14:11 - Laptop located powered on and connected to wired network.
14:13 - Photographed screen and physical connections.
14:16 - Incident lead authorised network isolation while maintaining power.
14:21 - Volatile-memory acquisition initiated.
📄 Objective Reporting Report what the evidence supports, including uncertainty
A Strong Report Distinguishes
"The logs show that Account A downloaded 4.2 GB from the customer database between 02:14 and 02:38."
"Employee A stole customer data."
Document Limitations
Digital investigations cannot always recover every artifact or answer every question.
Relevant events were not recorded or retained.
Relevant content could not be accessed.
Deleted information is no longer recoverable.
The forensic tool does not correctly interpret a particular artifact.
Relevant evidence source is unavailable.
Cloud or third-party information is unavailable.
🔒 Preservation & Legal Hold Normal deletion processes may need to stop when information must be preserved
When an appropriate preservation obligation applies, relevant information may need to be protected from routine deletion or destruction.
Email logs are automatically deleted after 90 days.
Relevant records are identified for preservation.
The organisation may need to prevent those records from being deleted according to applicable legal and organisational requirements.
🔐 Investigation Does Not Eliminate Privacy Collect what is authorised and relevant
Investigators may encounter:
Protect the Evidence Repository
Forensic evidence may contain passwords, confidential information, malware, personal data and detailed information about security weaknesses.
Restrict access to authorised investigators.
Protect evidence where appropriate during storage and transfer.
Record access to evidence repositories.
Detect unauthorised changes.
Prevent loss of critical investigative evidence.
Retain and eventually dispose according to applicable requirements.
Incident Response vs Digital Forensics
Focuses on containing, mitigating and recovering from a security incident.
STOP THE DAMAGE
Focuses on preserving and examining evidence to understand relevant activity.
UNDERSTAND THE EVIDENCE
Incident responders may want to shut down a compromised server immediately.
Forensic investigators may want to preserve volatile evidence first.
The organisation must balance evidence value with operational, security, safety and business requirements.
Ransomware Is Running Right Now
A workstation is actively encrypting network files.
The computer is:
Actual actions depend on authorisation, incident severity, business impact, available skills and the environment.
Possible Insider Data Theft
An employee is suspected of copying confidential customer information before leaving the organisation.
Compromised Cloud Administrator
A cloud administrator account is suspected of creating unauthorised access keys and downloading sensitive information.
The Unlocked Phone
Investigators receive an unlocked mobile phone relevant to an authorised investigation.
An inexperienced analyst starts:
- opening applications;
- reading messages;
- taking screenshots;
- changing device settings.
The Attack Happened 91 Days Ago
Security discovers evidence indicating that an attacker entered the environment three months earlier.
The relevant authentication logs are retained for:
90 days.
They were deleted yesterday.
🎓 CISSP Scenarios Recognise the investigation or forensic principle being tested
A security analyst discovers suspicious activity and immediately accesses an employee's private mailbox without verifying whether this is authorised.
Primary concern?
Investigative authority and privacy requirements.
A forensic examiner needs to determine who handled a laptop after it was collected.
Which record?
Chain of custody.
Evidence was transferred to another investigator, but no transfer was documented.
Which problem?
Break in chain-of-custody documentation.
The organisation wants to demonstrate that a forensic image has not changed since acquisition.
Which control is particularly useful?
Cryptographic hash verification.
A forensic image has the correct hash but nobody knows who possessed the drive for two weeks.
Is the hash a replacement for custody records?
No.
An investigator analyses the only original copy of evidence and repeatedly modifies it.
Better approach?
Preserve the original and analyse verified working copies where practical.
A forensic examiner connects a storage drive to an analysis computer while preventing writes to the evidence device.
Which mechanism?
Write blocker.
Investigators need information about processes and active network sessions on a running computer.
Which evidence source?
Volatile / live-system evidence.
The investigator powers off a machine before collecting RAM.
What happens?
The volatile-memory evidence is lost.
An investigator needs both RAM and disk evidence.
Which should generally receive earlier consideration?
The more volatile evidence.
Running a memory-acquisition tool changes some system state.
Does that automatically make live forensics invalid?
No.
The changes and method should be understood and documented.
The examiner extracts browser history from a forensic image.
Examination or analysis?
Examination.
The examiner correlates browser history with login records to determine the sequence of attacker activity.
Examination or analysis?
Analysis.
Security combines endpoint, VPN, identity and firewall events into a chronological sequence.
Which technique?
Timeline analysis / event reconstruction.
Two logs appear one hour apart because one records UTC and the other records local summer time.
Which consideration?
Time normalisation and time-zone interpretation.
A deleted document no longer has normal filesystem references, but its identifiable data structure can still be recovered.
Which technique?
File carving.
An investigation analyses packets captured from a compromised network segment.
Which artifact category?
Network artifact.
Investigators know which hosts communicated but do not have the full packet payload.
Which evidence may provide this summary?
Network flow data.
Investigators want details about calls, messages and application data from a smartphone.
Which speciality?
Mobile-device forensics.
An investigator casually opens applications on a seized mobile device before acquiring evidence.
Primary concern?
Modification of evidence state.
A cloud virtual machine has already been automatically destroyed.
Which other evidence may be especially important?
Cloud audit logs, identity events, snapshots and provider evidence.
A cloud provider possesses evidence that the customer cannot directly access.
Which consideration?
Provider dependency and shared responsibility.
An organisation enables detailed cloud audit logging before any incident occurs.
Which concept?
Forensic readiness.
Security discovers an intrusion after all relevant logs have already expired.
Which programme weakness?
Insufficient forensic logging / retention readiness.
A forensic tool generates a timestamp but the examiner cannot explain what that timestamp represents.
Primary concern?
Tool output is being used without sufficient interpretation.
A forensic tool version has never been validated and produces inconsistent results.
Primary concern?
Tool reliability and validation.
A suspicious executable exists in a user's download directory.
Does this prove the user intentionally executed it?
No.
Additional evidence is required.
Logs show that an employee's account authenticated from a remote address.
Does this alone prove the employee personally performed the login?
No.
Malicious traffic originates from a particular IP address.
Does this automatically identify the human attacker?
No.
An investigator records every collection step, tool version, hash and significant action.
Which 7.1 objective?
Reporting and documentation.
An investigation report describes facts, interpretations and limitations separately.
Why is this useful?
It supports objective and defensible reporting.
Relevant data cannot be recovered because it was overwritten.
What should the examiner do?
Document the limitation rather than invent a conclusion.
An investigator finds unrelated confidential employee information while examining an authorised evidence source.
What principle remains relevant?
Privacy, scope and appropriate handling.
Evidence needed for an active legal matter would normally be deleted tomorrow under the routine retention schedule.
What may be required?
Authorised preservation / legal-hold procedures.
Incident response wants to shut down a compromised machine while forensic investigators want to capture RAM.
Which issue?
Balance operational containment with preservation of volatile evidence.
A security team preserves memory before acquiring the hard disk.
Which principle?
Order of volatility.
Investigators secure evidence in a repository but every administrator has unrestricted access to it.
Primary problem?
Evidence access control and integrity risk.
A report says: "The evidence does not allow us to determine which individual used the compromised account."
Is that necessarily a weak conclusion?
No.
It may be the most accurate evidence-supported conclusion.
An investigator examines only endpoint evidence even though the incident occurred in a SaaS platform.
What is missing?
Relevant cloud/service artifacts.
The investigation cannot determine the sequence of events because each system uses a different unsynchronised clock.
Which preparedness weakness?
Time synchronisation / forensic readiness.
Recognise the Clue Words
Before Collecting
Permission.
AuthorisationWho Handled It?
Evidence history.
Chain of CustodyHas Data Changed?
Integrity.
HashPrevent Writing
Source media.
Write BlockerPreserve Original
Analyse copy.
Forensic ImageRAM
Disappears on power loss.
Volatile EvidenceMost Transient First
Collection priority.
Order of VolatilityExtract Artifacts
Before interpretation.
ExaminationWhat Do Artifacts Mean?
Interpretation.
AnalysisEvents in Sequence
Reconstruction.
Timeline AnalysisMultiple Log Sources
Connect evidence.
CorrelationRecover File Without Metadata
Structure.
File CarvingFull Network Detail
Communication.
Packet CaptureWho Talked to Whom?
Network summary.
Flow DataCalls + Apps + Location
Device evidence.
Mobile ForensicsCloud API Actions
Administrative evidence.
Control-Plane LogsPrepare Logging in Advance
Investigation capability.
Forensic ReadinessTool Says...
Understand output.
Validate / InterpretWhat Evidence Shows
Direct observation.
FactWhat It Probably Means
Reasoning.
InferenceCannot Determine
Evidence insufficient.
Document LimitationRoutine Deletion Must Stop
Preserve evidence.
Legal Hold / PreservationIncident Needs Containment
Stop damage.
Incident ResponseNeed to Understand Events
Preserve + investigate.
Digital Forensics⚠️ Common CISSP Mistakes Digital evidence is useful only when it remains trustworthy and correctly interpreted
Confirm scope and authority before accessing evidence.
Relevant legal, organisational and privacy requirements still apply.
Hashing supports integrity.
Chain of custody records evidence handling.
Preserve original evidence and use verified copies where appropriate.
Logical acquisition and physical acquisition provide different evidence.
Shutdown can destroy volatile evidence.
Continued operation can create additional security and evidential risk.
Consider more volatile evidence when it is relevant.
Live acquisition itself affects system state and should be performed deliberately and documented.
Examination extracts artifacts.
Analysis interprets them.
Many normal system activities create digital artifacts.
Determine the process and context that generated it.
Credentials can be stolen or delegated.
Attribution may require additional evidence.
Understand the tool, artifact and limitations.
Correct methods and interpretation matter more than tool count.
Packet capture can provide detailed communication information.
Flow records primarily summarise communications.
Evidence sources change, and provider cooperation may become important.
Forensic readiness must exist before evidence is needed.
Retention, integrity, timestamps and access to the logs also matter.
Incident response focuses on controlling the incident.
Forensics focuses on evidence and reconstruction.
Evidence must still be examined, analysed and interpreted.
Conclusions should reflect the strength and limitations of the evidence.
It may be the only defensible conclusion when evidence is insufficient.
Evidence requires appropriate confidentiality, integrity, access control and retention.
Quick Reference
| If you see... | Think... |
|---|---|
| Can we legally / organisationally investigate? | Authority |
| Who handled evidence? | Chain of Custody |
| Prove data remained unchanged | Hash |
| Prevent evidence drive modification | Write Blocker |
| Low-level storage copy | Physical / Forensic Image |
| Selected files or service data | Logical Acquisition |
| RAM, processes, sessions | Volatile Evidence |
| Collect transient information first | Order of Volatility |
| Extract artifacts | Examination |
| Interpret artifacts | Analysis |
| Events chronologically | Timeline Analysis |
| Connect several evidence sources | Correlation |
| Recover based on file structure | File Carving |
| Full network communication detail | Packet Capture |
| Communication metadata / summary | Flow Data |
| Calls, messages, apps, location | Mobile Forensics |
| Cloud administrative activity | Control-Plane / API Logs |
| Prepare logging before incident | Forensic Readiness |
| Tool produces result | Validate + Interpret |
| Evidence directly demonstrates something | Fact |
| Conclusion derived from evidence | Inference |
| Evidence cannot answer question | Document Limitation |
| Stop ordinary deletion | Preservation / Legal Hold |
| Stop incident damage | Incident Response |
| Understand what occurred | Digital Forensics |
Chain of Custody Memory Aid
Digital Forensics Memory Aid
Artifact Memory Aid
Volatility Memory Aid
Collect what disappears before what remains.
7.1 Master Memory Aid
Authorise → Preserve → Collect → Examine → Analyse → Report
The Investigator's Questions
Key Takeaways
CISSP 7.1 focuses on understanding and complying with investigations.
The current CISSP outline specifically includes evidence collection and handling, reporting and documentation, investigative techniques, digital-forensics tools, tactics and procedures, and artifacts such as data, computer, network and mobile-device evidence.
Investigative authority should be understood before investigators access, collect or examine information.
Legal, privacy, employment, contractual and regulatory requirements can affect how an investigation is conducted.
Technical ability to access information does not automatically provide authority to investigate it.
Digital forensics applies structured investigative methods to electronic evidence.
A practical forensic lifecycle is:
Identify → Preserve → Collect → Examine → Analyse → Report.
Examination identifies and extracts relevant artifacts.
Analysis interprets those artifacts and reconstructs relevant activity.
Examine = what artifacts exist? Analyse = what do they mean?
Digital evidence is easy to alter and should therefore be collected and handled using procedures that maintain integrity and provenance.
Chain of custody records the handling and movement of evidence throughout its lifecycle.
Important chain-of-custody information includes the evidence identifier, handler, collection details, transfers, dates, times, locations and reasons for transfer.
Chain of custody answers: Who had the evidence, when, where and why?
Cryptographic hashes can help demonstrate that digital evidence has not changed from a known reference value.
Hashing and chain of custody support different aspects of evidence assurance.
Hash = integrity. Chain of custody = handling history.
Where practical, original digital evidence should be preserved while examination is performed using verified copies.
A physical or bit-level acquisition and a logical acquisition provide different kinds of evidence.
Write blockers can help prevent modification of source storage during appropriate forensic acquisition.
Some digital evidence is volatile.
RAM, running processes and active network sessions may disappear when a system loses power.
Persistent storage such as disks generally survives power loss.
Preserve evidence that may disappear before evidence likely to remain.
Live acquisition may capture valuable volatile information but also changes some system state.
Offline acquisition avoids many live-system changes but loses volatile information.
The decision depends on investigative objectives, authority, evidence value, operational risk and the environment.
There is therefore no universal rule that every suspicious computer should immediately be powered off.
Investigative techniques can include timeline analysis, log correlation, metadata analysis, keyword searching, deleted-data recovery, file carving, memory analysis and network analysis.
Timeline analysis puts relevant events into chronological order.
Correlation combines multiple evidence sources to establish context and strengthen understanding of events.
Accurate time interpretation is essential for correlation.
Time zones, clock drift and differing timestamp formats can make events appear to occur at different times.
Before trusting the timeline, understand the clocks.
Digital artifacts are traces created or stored by digital activity.
Artifact sources include files, metadata, operating-system information, memory, application logs, network records, mobile devices and cloud services.
An artifact is not automatically evidence of malicious behaviour.
Investigators should understand how an artifact was generated before assigning meaning to it.
Artifact ≠ entire story.
Computer artifacts can include filesystem information, operating-system logs, browser records, memory, user profiles and persistence mechanisms.
Network artifacts can include packets, flow records, DNS, DHCP, firewall, proxy, VPN and detection-system information.
Packet captures and flow records provide different levels of network evidence.
Packet = detailed communication. Flow = communication summary.
Mobile forensic evidence can include messages, call information, application data, photographs, browser history, location information and device logs.
Mobile devices require careful preservation because connectivity, encryption, remote-management functions and normal device operation can alter evidence.
Cloud forensics introduces additional challenges because evidence may be distributed across services and controlled partly by external providers.
Cloud evidence may include identity logs, API activity, control-plane events, service logs, snapshots and object versions.
Ephemeral cloud resources can disappear quickly, making forensic readiness particularly important.
Cloud does not eliminate forensics. It changes where evidence exists and who controls it.
Forensic readiness means preparing systems, logging, retention, procedures, skills and provider arrangements before an investigation is required.
Logging alone is not enough.
Logs must also be available, protected, appropriately retained, time-aligned and accessible to authorised investigators.
The worst time to discover that evidence was never collected is after the incident.
Digital-forensics tools should be understood and appropriately validated.
Investigators should know what a tool does, its version, configuration, supported evidence types and known limitations.
Tool output still requires knowledgeable interpretation.
Modern operating systems and applications change over time, and the meaning of forensic artifacts may change with them.
Investigators should distinguish directly observed facts from interpretations and inferences.
Authentication logs demonstrating use of an account do not automatically prove which human physically performed the action.
Similarly, a source IP address does not automatically identify the human responsible for activity.
Evidence should support attribution rather than attribution being assumed from one technical indicator.
Investigation reports should record scope, authority, evidence, custody, methodology, tools, integrity information, findings, timelines, limitations and conclusions as appropriate.
Contemporaneous notes help create a reliable record of investigative actions.
Reports should distinguish facts from inference and clearly state limitations.
Digital investigations cannot always answer every question.
Missing logs, encryption, overwritten information, unavailable devices and tool limitations may prevent definitive conclusions.
"Unable to determine" is better than an unsupported conclusion.
Applicable preservation requirements may require information to be protected from routine deletion.
Investigations may expose unrelated sensitive information, so privacy, authorisation and appropriate data handling remain important.
Forensic evidence should itself be treated as a sensitive organisational asset and protected from unauthorised access, alteration or loss.
Incident response and digital forensics have related but different objectives.
Incident response focuses on stopping damage, containing incidents and restoring operations.
Digital forensics focuses on preserving evidence and understanding what occurred.
Those objectives sometimes compete, especially when volatile evidence exists on a system that also needs urgent containment.
The central CISSP principle is: obtain appropriate authority, preserve evidence before it disappears or changes, document its handling, use reliable investigative techniques, distinguish evidence from assumptions and report only conclusions that the evidence can support.
📚 Sources & Further Reading Current and foundational digital-forensics references
- ISC2 - CISSP Certification Exam Outline
View the current CISSP Exam Outline - NISTIR 8354 - Digital Investigation Techniques: A NIST Scientific Foundation Review
View the NIST digital-investigation review - NISTIR 8387 - Digital Evidence Preservation: Considerations for Evidence Handlers
View NIST digital-evidence preservation guidance - NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response
View NIST forensic and incident-response guidance - NIST SP 800-201 - Cloud Computing Forensic Reference Architecture
View NIST cloud-forensics guidance - NIST SP 800-101 Rev. 1 - Guidelines on Mobile Device Forensics
View NIST mobile-forensics guidance - NIST Computer Forensics Tool Testing Program - CFTT
View NIST forensic-tool testing resources - NIST CSRC - Chain of Custody
View the NIST chain-of-custody definition