AdvancedSecurity Operations

Digital Forensics Basics: Collecting and Analyzing Evidence

Learn digital forensics fundamentals including evidence collection, forensic imaging, memory analysis, timeline analysis, and proper chain of custody procedures for investigations.

#Digital Forensics#Evidence Collection#Memory Analysis#Forensic Imaging#Chain of Custody

The Memory Dump That Convicted a Hacker

In 2011, a group calling itself "Anonymous" breached HBGary Federal and leaked 68,000 internal emails. During the investigation, forensic analysts captured memory dumps from compromised servers before anyone hit the power button. That single decision — acquiring RAM before disk — preserved running processes, active network connections, and decrypted credentials that would have vanished with a reboot. The evidence led directly to the attackers. Memory forensics proved that volatile data is often the most valuable data.

Digital forensics is the process of preserving, collecting, analyzing, and presenting digital evidence in a manner that is legally admissible. The fundamental principle is that digital evidence is fragile — improper handling can destroy or invalidate it.

Prerequisites

**Incident Response** — Understanding of containment and evidence preservation

**Log Analysis** — Familiarity with system and application logs

**File Systems** — Basic understanding of NTFS, ext4, and FAT32

Forensic Principles

The Locard Exchange Principle

Every interaction leaves a trace. When an attacker compromises a system, they leave digital artifacts — registry modifications, log entries, file creations, memory artifacts, and network connections.

Order of Volatility

Digital evidence must be collected from most volatile to least volatile:

**CPU registers and cache** — Extremely volatile, microseconds

**Memory (RAM)** — Volatile, milliseconds to seconds

**Network connections and state** — Seconds to minutes

**Running processes** — Seconds to minutes

**Disk storage** — Persistent (weeks to years)

**Archived data** — Long-term persistent

**Physical logs** — Most persistent

# Live response: collect volatile data first
# Order of execution matters

# 1. Running processes
ps aux > processes.txt

# 2. Network connections
netstat -anob > network.txt

# 3. Active network connections
lsof -i > connections.txt

# 4. Current user sessions
who /users > users.txt

# 5. System uptime and time
uptime && date > timing.txt

# 6. Loaded kernel modules
lsmod > modules.txt

Chain of Custody

Chain of custody is the documentation trail that shows evidence was handled properly from collection to courtroom presentation. Every transfer must be documented.

Chain of Custody Record
Evidence ID: DF-2026-001
Description: Forensic image of server FS-01
MD5 Hash: a1b2c3d4e5f6...

Date/Time         Person                 Action        Location
2026-06-01 14:00  John Doe (Analyst)     Collected     Server Room A
2026-06-01 16:30  John Doe (Analyst)     Transferred   Lab 2 to Evidence Locker
2026-06-02 09:00  Jane Smith (Analyst)   Accessed      Evidence Locker
...continue for each access...

Forensic Imaging

Write Blockers

Forensic imaging must never modify the source drive. Hardware write blockers prevent any writes to the source. Software write blockers provide an additional layer.

# Verify write blocker is working
# Device should show as read-only
dmesg | grep -i "write protected"

# Identify the target disk
lsblk
sudo fdisk -l

Creating Forensic Images

# DD imaging (bit-for-bit copy)
sudo dd if=/dev/sdb of=/evidence/disk_image.dd bs=4M conv=noerror,sync status=progress

# Verify integrity with SHA256
sha256sum /evidence/disk_image.dd > /evidence/disk_image.sha256

# Using Guymager (GUI forensic imager)
sudo guymager

# Creating EWF (EnCase) format
sudo ewfacquire /dev/sdb -t /evidence/case001

Memory Analysis

Memory contains volatile evidence: running processes, loaded DLLs, network connections, open files, decrypted data (passwords in clear), encryption keys, and rootkits.

Acquiring Memory

# Using LiME (Linux Memory Extractor)
insmod lime.ko "path=/evidence/ram.mem format=lime"

# Using avml (Acquire Volatile Memory Linux)
sudo ./avml /evidence/ram.mem

# Windows memory with winpmem
winpmem_mini_x64_rc2.exe /evidence/ram.raw

# Using FTK Imager (Windows GUI)
# File → Create Memory Image

Analyzing Memory with Volatility

# Identify the OS profile
volatility -f ram.mem imageinfo

# List running processes
volatility -f ram.mem --profile=Win10x64 pslist
volatility -f ram.mem --profile=Win10x64 pstree
volatility -f ram.mem --profile=Win10x64 psscan  # Unlinked/hidden processes

# Network connections
volatility -f ram.mem --profile=Win10x64 netscan

# DLLs loaded by a specific process
volatility -f ram.mem --profile=Win10x64 dlllist -p 1234

# Extract command line arguments
volatility -f ram.mem --profile=Win10x64 cmdline

# Dump a process for analysis
volatility -f ram.mem --profile=Win10x64 memdump -p 1234 -D /evidence/

# Scan for injected code
volatility -f ram.mem --profile=Win10x64 malfind

# Registry hives in memory
volatility -f ram.mem --profile=Win10x64 hivelist

File System Analysis

Finding Suspicious Files

# Using The Sleuth Kit
# List files in an NTFS image
fls -o 2048 disk_image.dd

# Recover deleted files
icat disk_image.dd 65-128-1 > recovered_file.txt

# Timeline analysis
mac-robber /mnt/evidence > bodyfile.txt
mactime -b bodyfile.txt > timeline.csv

Windows Registry Analysis

# Using regripper or python-registry
# Extract registry hives
samparse SYSTEM SAM

Timeline Analysis

Timelines reconstruct the sequence of events. A timeline shows what happened and when, enabling investigators to identify the attack chain.

# Create a super timeline
sudo fls -r -m /evidence /dev/sdb1 > bodyfile
sudo mactime -b bodyfile -d > timeline.csv

# Analyze timeline for suspicious events
grep -i "powershell|wmic|psexec|schtasks" timeline.csv

Real-World Example: Forensics on a Compromised Server

Scenario: A Linux web server is suspected of compromise.

**Live Response**: Collect memory, running processes, network connections, and logged-in users

**Imaging**: Create a forensic image of the disk using dd with write blocker

**Analysis**: Memory analysis reveals a hidden process not shown by ps (rootkit)

**Timeline**: File system timeline shows unusual file modifications 3 days prior

**Log Analysis**: Apache logs show SQL injection attempt 3 days prior

**Persistent Artifact**: A cron job executes a reverse shell every 5 minutes

**Conclusion**: SQL injection → web shell → rootkit installation → persistence via cron

Common Mistakes

**Not following order of volatility** — Losing volatile evidence by powering off first

**Failing to document chain of custody** — Inadmissible evidence

**Analyzing original evidence** — Always work from copies, never the original

**Missing time zone considerations** — UTC timestamps must be interpreted correctly

**Insufficient hashing** — Cannot prove evidence integrity without cryptographic hashes

Best Practices

**Follow the order of volatility** — Collect RAM first, disk second

**Document everything** — Actions, observations, timestamps, and chain of custody

**Use write blockers** — Never write to original evidence

**Create multiple copies** — Work from copies, store originals in secure location

**Verify integrity** — Hash evidence at collection and at each transfer

**Use validated tools** — Tools should be forensically sound and tested

**Maintain impartiality** — Let evidence speak, avoid confirmation bias

Related Tools

**The Sleuth Kit (TSK)** — File system analysis

**Autopsy** — GUI for TSK

**Volatility** — Memory analysis framework

**Guymager** — Forensic imaging

**FTK Imager** — Windows imaging and preview

**Binwalk** — Firmware analysis

Incident Response: Structured Approach to Security Breaches

Log Analysis: Extracting Intelligence from System Logs

Threat Hunting: Proactive Cyber Defense Strategies

SIEM Fundamentals: Security Information and Event Management

Detection Engineering: Creating Security Alerts and Rules

Summary

Digital forensics preserves and analyzes digital evidence for investigations. Key principles include the order of volatility, chain of custody, and working from copies. Core techniques include forensic imaging (dd, Guymager), memory analysis (Volatility), file system analysis (TSK), and timeline creation. Proper evidence handling, documentation, and adherence to forensic principles ensure findings are legally admissible.

Knowledge Check

What is the order of volatility and why must it be followed?

What is chain of custody and why is it essential?

What tools are used for memory analysis?

Why must forensic imaging use write blockers?

What does a timeline analysis reveal in an investigation?

Frequently Asked Questions

What is the order of volatility in digital forensics?

The order of volatility requires collecting evidence from most volatile to least volatile: CPU registers, RAM, network state, running processes, disk storage, and archived data. Following this order prevents loss of critical volatile evidence that disappears when systems are powered off.

Why must forensic imaging use write blockers?

Write blockers prevent any modification to the original evidence disk during imaging. Without them, the forensic process itself could alter timestamps, delete files, or change metadata, rendering the evidence inadmissible in court and compromising the investigation.

What is chain of custody and why is it essential?

Chain of custody is the documentation trail showing every person who handled evidence, when, and what they did. It proves evidence integrity in court. Without proper chain of custody, digital evidence may be ruled inadmissible regardless of its investigative value.

What tools are used for memory analysis?

Volatility is the primary open-source memory analysis framework. It can identify running processes, network connections, loaded DLLs, registry hives, and injected code from RAM dumps. LiME and avml are used for Linux memory acquisition; winpmem for Windows.

What is a forensic disk image and how is it created?

A forensic image is a bit-for-bit copy of a storage device created using tools like dd, Guymager, or FTK Imager with a write blocker attached. The image is verified using SHA256 hashes to prove the copy is identical to the original, preserving all data including deleted files.

What is timeline analysis in digital forensics?

Timeline analysis reconstructs the sequence of file system events (MAC times: modified, accessed, created) to visualize what happened and when. It reveals attack chains by showing file modifications, process executions, and user activity in chronological order.

What is the Locard Exchange Principle?

Locard's principle states that every interaction leaves a trace. In digital forensics, this means attackers always leave artifacts — registry changes, log entries, created files, and network connections — that can be discovered and used to reconstruct their activities.

How do you acquire memory from a running system?

Use LiME (Linux Memory Extractor) with insmod lime.ko, avml for Linux, winpmem for Windows, or FTK Imager's memory acquisition feature. Memory must be captured before powering off the system, as RAM contents are lost immediately on shutdown.

What can Volatility reveal from a memory dump?

Volatility can extract running and hidden processes, network connections, loaded DLLs, command-line arguments, registry hives, injected code (malfind), and decrypted credentials. It is essential for detecting rootkits and memory-resident malware that evade disk-based detection.

Why must forensic analysts work from copies, never originals?

Working from copies preserves the integrity of original evidence. If the original is accidentally modified during analysis, the investigation is compromised. Multiple copies should be created, verified with hashes, and originals stored securely while analysts work from verified duplicates.