Digital forensics fundamentals

Forensics is the discipline of evidence: collect it so it cannot be disputed, analyze copies instead of originals, and document every step so another examiner reaches the same result.

Volatility 3Autopsy / The Sleuth KitKAPEFTK Imager / dc3ddPlaso / Timesketchhash tools (sha256sum)

Principles

Preserve: change as little as possible, and prove integrity with cryptographic hashes taken at collection.
Work on copies: acquire a forensic image and analyze the image, never the original.
: collect the most fragile evidence first. Memory, then running processes and network connections, then temporary files, then disk, then logs and backups.
: a written record of who held the evidence, when, and what was done to it. It is what makes evidence credible in a dispute.
Document everything: commands, times (in UTC), tools and versions, and your reasoning.
Legal and privacy: have authority to collect, and handle personal data as the law and policy require. Involve counsel when a case may go to court.

Acquiring evidence

Use a hardware or software for physical media, capture memory before powering a system down, and hash the result. The commands below are the standard pattern; real cases often use dedicated acquisition tools.

acquire-disk.shbash

# image a disk read-only (use a write blocker on physical media)
sudo dd if=/dev/sdb of=case42/evidence01.img bs=4M conv=noerror,sync status=progress

# prove integrity: record the hash at collection and re-verify later
sha256sum case42/evidence01.img | tee case42/evidence01.img.sha256
sha256sum -c case42/evidence01.img.sha256

# make a working copy and analyze that, never the original image
cp case42/evidence01.img case42/work01.img

chain-of-custody.txttext

Case: INC-2026-0142    Item: evidence01.img (disk of web-prod-03)
SHA-256: <hash recorded at acquisition>

2026-10-13 15:10Z  collected by A. Silva, write-blocked, dc3dd v7.2
2026-10-13 16:00Z  transferred to evidence locker, sealed bag #118 (A. Silva -> M. Souza)
2026-10-14 09:05Z  checked out for analysis (M. Souza), hash re-verified OK
2026-10-14 17:30Z  returned to locker, hash re-verified OK

What to look at

Memory: running and hidden processes, network connections, loaded modules and injected code, credentials in memory.
Disk: file system timeline, deleted files, recently run programs, persistence locations (startup items, scheduled tasks, services).
Windows artifacts: event logs, registry hives, prefetch, amcache and shimcache, browser history.
Linux artifacts: shell history, auth and system logs, cron jobs, SSH keys, modified binaries.
Cloud and SaaS: audit logs and configuration state; the evidence often lives in the provider's logs, not on a disk.

memory-analysis.sh (Volatility 3)bash

vol -f mem.raw windows.pslist          # running processes
vol -f mem.raw windows.pstree          # parent-child relationships
vol -f mem.raw windows.cmdline         # command lines
vol -f mem.raw windows.netscan         # network connections and listeners
vol -f mem.raw windows.malfind         # memory regions that look like injected code

Reporting

A forensic report states what was examined, how, what was found, and what it means, separating observation from interpretation. Write so a reader who was not there can follow the reasoning and reproduce it. State limits honestly: what you could not determine and why.

Order of volatilityThe principle of collecting the most fragile evidence first: memory, then processes and connections, then temporary files, then disk and logs.see in glossary →Chain of custodychain of custodyA record of who collected, stored and handled each piece of digital evidence, and when. Without it, the evidence loses value for audits and for any legal dispute.see in glossary →Write blockerA device or software that lets you read a disk without allowing any change to it, so the evidence stays intact.see in glossary →

connections on the map

Triage, scoping and containmentpreserves evidence forDigital forensics fundamentals
Digital forensics fundamentalshands samples toMalware analysis fundamentals

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Logging & detection - signals and alertscloudseccloud evidence lives in the audit logs