CHFI · Domain 3
Procedures, Methodology and Forensic Tools
About 28% of the exam
First responder at the scene
- Secure the scene
- Photograph everything
- Assess power state
- Collect volatile data
- Label and seal
- Transport and log
- Photograph screens, cables and layout
- Label every cable before disconnecting
- Wear gloves to avoid contamination
- Keep suspects away from keyboards
- Record who was present and when
Powered on or powered off
- Running system
- capture volatile data before shutdown
- Encrypted and unlocked
- acquire now or lose access
- Powered off desktop
- leave it off, image later
- Mobile device
- shield it, keep it charged
- Server
- live acquisition, downtime rarely acceptable
- Active destruction
- stop the harm, justify the choice
Pulling power on an encrypted machine can convert readable evidence into an unopenable container
Order of volatility
- Cache and registers
- Memory
- Network state
- Running processes
- Temporary files
- Disk and archives
- Volatile state dies with the power
- Routing and connection tables are transient
- Open handles vanish at shutdown
- Disk and backups can wait
Collect in order of how fast it disappears, and record the system clock before you touch anything else
Write blocking
- Hardware blockers refuse write commands
- Software blockers rely on the operating system
- Test the blocker before every case
- Mount images read only for analysis
- Blocked does not mean no read errors
- Record the blocker model in the log
Acquisition types
Physical
- Every sector including unallocated and slack
- Best recovery potential from deleted content
- Slowest and largest output
- Needed for carving and hidden areas
Logical and sparse
- Only files visible to the system
- Chosen when scope or time is limited
- Sparse takes named items for triage
- Still hashed, still documented
Live and remote
- Running systems change while you copy
- Hash verifies the image, not the source
- Remote pulls cross networks you must document
- Cloud data requires provider process
Match the acquisition to the authority and the evidence, then state in the report exactly which one you chose
Image formats
- Raw
- sector for sector, no metadata
- Expert witness format
- compression, case metadata, block checks
- Advanced format
- sparse aware, multiple streams, verification
- Split segments
- large images divided for portability
- Virtual disk
- chain of parent and delta files
- Proprietary risk
- long term readability depends on a vendor
Hashing and verification
- Hash the source before acquisition
- Hash the image after acquisition
- Compare and record both values
- Use a strong algorithm alongside a legacy one
- Re-verify after transport and storage
- Explain any mismatch rather than repeating it
Evidence packaging
- One item, one bag, one label
- Tamper evident seals with signatures
- Antistatic packaging for bare drives
- Shielded storage for radio capable devices
- Controlled temperature and humidity storage
- Access to the store is logged
Tool categories
- Imagers
- acquire and verify media
- Analysis suites
- parse file systems and artifacts
- Carvers
- recover files without metadata
- Registry parsers
- decode hives into readable output
- Memory frameworks
- interpret captured volatile memory
- Timeline builders
- merge artifacts into one chronology
- Mobile kits
- logical, file system and physical extraction
Validation and defensibility
Before the case
- Test tools against known data sets
- Record versions and configuration
- Keep validation results on file
- Retest after every major update
During the case
- Confirm key findings with a second tool
- Investigate discrepancies rather than picking one
- Log every action the tool performed
- Work only on verified copies
After the case
- Peer review before the report is issued
- Retain the case file and exhibits
- Document the disposition of evidence
- Capture lessons for the procedure
Two tools disagreeing is a finding to explain, never a menu to choose from
Examination workflow
- Verify the image before analysis
- Build a file system overview first
- Run signature analysis across the volume
- Filter known good files out
- Keyword search with a documented list
- Pivot from hits to context
Documentation discipline
- Contemporaneous notes, not reconstructed memory
- Record the legal basis for each examination
- Note items considered and deliberately not collected
- Capture equipment problems even when resolved
- Timestamp entries in one reference zone
- Keep tool logs with the case file
Key artifacts
- Acquisition log
- tool, version, times, hashes
- Custody form
- each handler and each transfer
- Evidence inventory
- items seized and items declined
- Scene photographs
- state before anything was moved
- Verification record
- hash comparisons before and after
- Bad sector count
- unreadable regions during imaging
Know the order
- Authority confirmed
- Scene documented
- Volatile data captured
- Media imaged and hashed
- Copy analyzed
- Findings peer reviewed
The order itself is examinable: authority, documentation, volatility, verification, analysis, review
Reference strip: procedure and tooling
Scene steps
- Secure, photograph, document
- Assess power and encryption
- Collect volatile first
- Label, seal, transport
Acquisition choices
- Physical, logical, sparse
- Live versus powered off
- Remote and cloud collection
- Array and virtual disk handling
Formats
- Raw sector images
- Expert witness containers
- Advanced multi stream formats
- Split segment sets
Integrity
- Write blocking at acquisition
- Hash before and after
- Read only mounting
- Periodic re-verification in storage
Quality
- Validated tools with versions
- Dual tool confirmation
- Peer review of findings
- Complete contemporaneous notes
Quick exam traps
- Trap: A software write blocker makes hardware blocking unnecessary
- Trap: Live acquisition hashes must match the source disk
- Trap: Logical acquisition is never forensically defensible
- Trap: Mounting an image is safe without read only enforcement
- Trap: One tool reporting a result is enough for a key finding
- Trap: Volatile collection can wait until the machine reaches the lab
- Trap: Notes written from memory afterwards carry equal weight
cybercertprep.com · original revision sheet written from the public body of knowledge