Cybersecurity — Digital Forensics

Forensics process

1. Identification: Find evidence
2. Preservation: Secure evidence
3. Collection: Gather evidence
4. Examination: Analyze evidence
5. Analysis: Interpret findings
6. Reporting: Document results

Tools

# Disk imaging
dd if=/dev/sda of=evidence.img bs=4M

# Volatility (memory forensics)
volatility -f memory.dmp imageinfo
volatility -f memory.dmp --profile=Win7SP1x64 pslist

# Autopsy (GUI)
autopsy

Chain of custody

evidence_log = {
    'item_id': 'EVD-001',
    'description': 'Hard drive',
    'collected_by': 'John Doe',
    'date': '2024-01-01',
    'location': 'Server Room A',
    'hash': 'sha256:abc123...'
}

Evidence types

1. Volatile: RAM, network connections
2. Non-volatile: Hard drives, logs
3. Logical: Files, registry
4. Physical: Hardware

Best practices

1. Document everything
2. Maintain chain of custody
3. Use write-blockers
4. Verify integrity

Mini Practice

1. Create disk image
2. Analyze memory dump
3. Recover deleted files
4. Document findings

Up Next

Continue with Security Operations - SOC.