Digital Forensics Fundamentals: Evidence to Analysis

Digital forensics is the part of blue team work where mistakes are permanent. Modify a disk, lose a memory snapshot, break the chain of custody — evidence becomes inadmissible. This post covers the fundamentals: the forensic process, evidence collection, order of volatility, and the tools that actually work.

---

What is Digital Forensics?

Digital forensics is the scientific examination of digital devices and data to uncover evidence of incidents, intrusions, or criminal activity. It applies to:

• Computers and servers
• Mobile devices
• Network traffic
• Volatile memory (RAM)

When combined with Incident Response, the discipline is DFIR — Digital Forensics and Incident Response.

---

The Five-Step Process

Every forensic investigation follows the same steps.

1. Identification — locate potential evidence sources, custodians, data locations
2. Preservation — protect ESI (Electronically Stored Information), prevent tampering
3. Collection — acquire evidence through imaging, copying, or capturing
4. Analysis — systematically examine artifacts to uncover findings
5. Reporting — produce detailed, reproducible reports

The order matters. You can't analyze what you didn't preserve.

---

Order of Volatility (RFC 3227)

Collect evidence from most volatile to least volatile. Everything higher in this list disappears faster.

1. Registers & Cache — most volatile, changes constantly (rarely captured)
2. Memory (RAM) — active processes, network connections, encryption keys
3. Disk (HDD/SSD) — persistent but can be overwritten (SSD TRIM)
4. Remote Logging — log rotation may cause data loss
5. Physical Configuration — least volatile

Practical order:

Memory image → Triage image → Full disk image

Memory first because it's gone the moment the system powers off.

---

Memory Acquisition

Live Acquisition (System Powered On)

Three factors when choosing a tool:

• Footprint — smaller is better (less chance of overwriting evidence in RAM)
• Mode — kernel-mode tools access more memory and bypass anti-debugging
• Speed — faster acquisition reduces the chance of memory state changing mid-capture

Common Tools

Tool	Mode	Output
DumpIt	Kernel	.dmp / .raw
BelkaSoft RAM Capturer	Kernel	.mem
FTK Imager	User	.mem (with optional pagefile)

FTK Imager Workflow

1. File → Capture Memory
2. Choose save location
3. Optionally include pagefile
4. Run — wait for completion
5. Analyze with Volatility

Dead Acquisition (System Powered Off)

When RAM is unavailable, partial memory data may exist in:

• hiberfil.sys — full RAM snapshot from hibernation (size ≈ RAM size)
• pagefile.sys — paged-out RAM data (partial, may contain credentials/artifacts)
• C:\Windows\MEMORY.DMP — memory state at time of BSOD

Linux Memory Acquisition

• LiME (Linux Memory Extractor) for live acquisition
• Swap partition/file is the Linux equivalent of pagefile

---

Disk Acquisition

Write-Blocking (Non-Negotiable)

Critical rule: never modify original evidence during acquisition.

• Hardware write-blockers (e.g., Tableau)
  • OS-independent, physically prevent writes
  • Preferred for legal proceedings
• Software write-blockers
  • OS-level, less reliable
  • More accessible but riskier

Powering Off

When removing a disk, pull the power cable — don't do a clean shutdown. A clean shutdown modifies timestamps and overwrites files. Pulling power preserves the state.

Full Disk Imaging Workflow

FTK Imager:

1. File → Create Disk Image
2. Source: Physical Drive
3. Fill evidence metadata (case #, examiner, notes)
4. Set output format and location
5. Verify hashes after imaging

Linux:

# Bit-by-bit copy with progress
dd if=/dev/sda of=/mnt/evidence/sda.dd bs=4M conv=noerror,sync status=progress

# Hash the image during copy (tee branches the data stream)
dd if=/dev/sda | tee /mnt/evidence/sda.dd | sha256sum

Forensic tools like EnCase and FTK add metadata and chain of custody info automatically — prefer those when acquiring for legal use.

Image Formats

Format	Description
Raw (.dd/.img)	Bit-for-bit copy, no metadata
E01 (EnCase)	Compressed, with metadata and chain of custody
AFF4	Advanced Forensics Format, modern
VHD/VMDK	Virtual machine formats

---

Triage Imaging

Full disk imaging takes hours. Multi-TB drives take days. When you're under time pressure, collect only the high-value artifacts.

Key Windows Artifacts to Collect

• Event logs — %WinDir%\System32\winevt\Logs
• Registry hives — SAM, SYSTEM, SOFTWARE, DEFAULT, NTUSER.DAT, USRCLASS.DAT, Amcache.hve
• Memory artifacts — pagefile.sys, hiberfil.sys, CrashDumps
• User profiles — C:\Users\<username>
• File system artifacts — \(MFT, \)UsnJrnl
• Prefetch — evidence of program execution
• Browser data — history, cache, cookies
• Recycle Bin

KAPE (Kroll Artifact Parser and Extractor)

The go-to tool for triage collection:

• GUI and CLI versions
• Supports targeted artifact collection
• Deployable at scale via PowerShell
• Has pre-built "Targets" (what to collect) and "Modules" (how to process)

Typical KAPE workflow:

kape.exe --tsource C: --target KapeTriage --tdest D:\evidence\

---

Mounting Forensic Images

After acquisition, you need to analyze the image without modifying it.

• Arsenal Image Mounter — supports raw, E01, AFF4, VHD, VMDK. Has "Write temporary" mode for safe analysis.
• FTK Imager — can also mount and browse images
• Note: host OS must support the image's filesystem (ext4 images need extra utilities on Windows)

---

Evidence Integrity

Hashing

Generate hashes before and after any handling to confirm no changes.

Algorithm	Security Level	Windows	Linux
MD5	Low (collision risk)	Get-FileHash -Algorithm MD5 <file>	md5sum <file>
SHA1	Medium	Get-FileHash -Algorithm SHA1 <file>	sha1sum <file>
SHA256	High (preferred)	Get-FileHash <file>	sha256sum <file>

Best practice: calculate at least two different hashes for critical evidence. If one has a collision, the other catches it.

Chain of Custody

Log every step:

• What — the evidence item
• When — date and time
• Where — physical or logical location
• Who — the person handling it

Record all transfers, acquisitions, examiner details, storage procedures. Use tamper-proof bags, labels, and photographs. Keep evidence locked; only authorized personnel access it.

ACPO Principles

The four UK Association of Chief Police Officers principles that govern digital evidence handling:

1. Do not change data on a digital device that could be evidence
2. Access by competent individuals only — and they must explain their actions
3. Maintain a reproducible audit trail of all procedures
4. Lead investigator ensures all guidelines are followed

These exist because forensic evidence has to survive court challenges.

---

Equipment Checklist

A properly equipped forensic kit includes:

• Forensic workstation (CAINE, DEFT, or custom)
• Hardware write-blockers — including specialized ones for phones, IoT
• Blank hard drives — at least the size of the original
• Electrostatic evidence bags and tamper-proof stickers
• Grounding bracelets (ESD protection)
• Faraday bags/boxes (signal blocking for mobile devices)
• Labels and camera for documentation
• Dedicated flash drives with forensic tools (EnCase, FTK, CSILinux)

---

Sub-Domains of Digital Forensics

Digital forensics breaks down into several specializations:

Sub-Domain	Focus
Memory Forensics	Analysis of RAM dumps for processes, connections, malware, persistence
Disk Forensics	Windows/Linux artifacts, registry, event logs, file system
Network Forensics	Packet captures, flow data, protocol analysis
Mobile Forensics	Phones, tablets, IoT devices
Cloud Forensics	AWS/Azure/GCP logs, cloud storage, containers

Each has its own tools and methodologies — but they all share the fundamentals above.

---

Key Tools at a Glance

Tool	Purpose
Volatility (2 & 3)	Memory dump analysis framework
Autopsy	Disk image analysis and artifact extraction
FTK Imager	Memory capture and disk imaging
KAPE	Triage artifact collection
Registry Explorer	Windows registry analysis
Timeline Explorer	CSV-based timeline analysis
Arsenal Image Mounter	Mount forensic images safely

---

Key Takeaways

• Digital forensics = Identification → Preservation → Collection → Analysis → Reporting
• Order of Volatility — memory first, disk last
• Pull power, don't clean shutdown — timestamps matter
• Always use write-blockers during acquisition
• Hash before and after — prove evidence integrity
• Chain of custody is everything — document who touched what, when
• Triage imaging (via KAPE) when full imaging isn't practical
• Two hashes are better than one — MD5 + SHA256 minimum
• ACPO principles exist because evidence has to survive court
• Every sub-domain shares the same fundamentals