Objectives
- Apply the order of volatility
- Keep a chain of custody that has no gaps
Lesson
A running machine is losing evidence continuously. The order of volatility says what to take first:
- registers and cache
- routing table, ARP cache, process table, kernel statistics, and memory
- temporary file systems
- disk
- remote logging and monitoring data
- physical configuration and network topology
- archival media last
Pull the plug first and you have traded everything above the disk for tidiness.
Document the state before touching anything: what is on screen, what is running, and what the system clock reads against a trusted reference. That last one will matter more than it looks — see the next lesson.
Acquire, then hash source and copy, and record both values. Work only on the copy. On physical media use a write-blocker, because simply attaching a disk can let an operating system write to it and change the very timestamps you came for.
The chain of custody records item, description, who acquired it, when, how, the hash at acquisition, where it is stored, and every transfer with a time and a reason. A gap weakens the record and cannot be rebuilt from memory; US courts usually treat it as going to weight, not automatic exclusion. Nobody can testify about a period nobody documented, and the assurance the chain exists to give is exactly what is missing.
Report method as well as result. Name the tools and versions, and explain the choices, so another examiner can repeat the work. A result nobody can reproduce is an assertion with a filename.