Cyberstudy
PDF p.309 In progress

Acquisition

Open PDF at p.309 20 flashcards

Summary

PDF p.309

Acquisition involves obtaining a forensically clean copy of data from a device seized as evidence. Legal validity is crucial, especially with BYOD policies. The process is complex due to the nature of digital evidence and the need to capture it in the correct order of volatility.

In plain words

Supplementary — not from your PDF

Acquisition makes a forensically clean copy of evidence. First confirm that the search is legal (tricky with BYOD). Capture the most volatile data first: CPU registers and cache, then RAM (routing table, ARP cache, processes), then mass storage (including swap, hibernation files and temp caches), then remote logs, then physical configuration, then archival media. Some evidence disappears when power is removed; some can only be reached afterwards.

Detailed explanation

PDF p.309

Legal Validity

  • Ownership: Verify legal validity of search or seizure, especially for BYOD.
  • Mistakes: Any mistake can make evidence inadmissible.

Complexity of Data Acquisition

  • Digital vs. Physical: More difficult to capture evidence from a digital crime scene.
  • Power State: Some evidence is lost if the system is powered off; some is unobtainable until powered off.
  • Shutdown Method: Evidence may be lost depending on whether the system is shut down or "frozen" by disconnecting power.

Acquisition Process

  • Tool Usage: Use tools to make an image from the target device.
  • Volatility Order: Capture evidence from more volatile to less volatile storage.

Order of Volatility (ISOC Best Practice)

  • 1. CPU Registers and Cache Memory: Includes cache on disk controllers, graphics cards, etc.
  • 2. Nonpersistent System Memory (RAM): Routing table, ARP cache, process table, kernel statistics.
  • 3. Persistent Mass Storage Devices: HDDs, SSDs, flash memory devices.
    • Partition and File System Blocks: Slack space, free space.
    • System Memory Caches: Swap space/virtual memory, hibernation files.
    • Temporary File Caches: Browser cache.
    • User, Application, and OS Files and Directories.
  • 4. Remote Logging and Monitoring Data.
  • 5. Physical Configuration and Network Topology.
  • 6. Archival Media and Printed Documents.

Windows Registry

  • Storage: Mostly stored on disk, but some keys (e.g., HKLM\HARDWARE) exist only in memory.
  • Analysis: Can be analyzed via a memory dump.

Important terms

taken from the text above
Ownership
Verify legal validity of search or seizure, especially for BYOD.
Mistakes
Any mistake can make evidence inadmissible.
Digital vs. Physical
More difficult to capture evidence from a digital crime scene.
Power State
Some evidence is lost if the system is powered off; some is unobtainable until powered off.
Shutdown Method
Evidence may be lost depending on whether the system is shut down or "frozen" by disconnecting power.
Tool Usage
Use tools to make an image from the target device.
Volatility Order
Capture evidence from more volatile to less volatile storage.
CPU Registers and Cache Memory
Includes cache on disk controllers, graphics cards, etc.
Nonpersistent System Memory (RAM)
Routing table, ARP cache, process table, kernel statistics.
Persistent Mass Storage Devices
HDDs, SSDs, flash memory devices.
Partition and File System Blocks
Slack space, free space.
System Memory Caches
Swap space/virtual memory, hibernation files.
Temporary File Caches
Browser cache.
Storage
Mostly stored on disk, but some keys (e.g., HKLM\HARDWARE) exist only in memory.
Analysis
Can be analyzed via a memory dump.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Capturing RAM before shutting a system down.
  • Checking ownership before imaging an employee's personal phone.
  • Collecting remote log copies after local disks.

Scenario

A responder shuts down a compromised server to image its disk and loses all running processes and network connections in memory. The order of volatility says capture RAM first.

Common mistakes

Supplementary — not from your PDF
  • Powering off before capturing volatile data.
  • Ignoring legal ownership questions with BYOD devices.

Practical skills

Supplementary — not from your PDF
  • List evidence sources in order of volatility.

What I should remember

Key Points PDF p.309
  • Legal Validity: Verify for BYOD, avoid mistakes.
  • Complexity: Digital evidence capture, power state considerations.
  • Acquisition Process: Use tools, follow volatility order.
  • Volatility Order: From CPU registers to archival media.
  • Windows Registry: Disk and memory analysis.