Digital forensics basics: preserving evidence you can trust

Digital forensics is the careful collection and analysis of evidence from computers, phones and networks, in a way that can be trusted later: by the organisation deciding what to fix, by an insurer, or by a court. It sounds like something from a crime series, but its core rules are simple and apply to any investigation, even an internal one.

Rule one: do no harm to the evidence

The moment you start poking around a compromised machine, you change it. Opening files updates timestamps, running tools writes to disk and memory, and rebooting erases everything that was only in memory. NIST’s guide to integrating forensic techniques into incident response (SP 800-86) and the long-standing Internet guidance on evidence collection (RFC 3227) both stress the same point: preserve first, analyse later, and work on copies, not originals.

The order of volatility

Some evidence disappears faster than other evidence. RFC 3227 recommends collecting from the most volatile to the least volatile, so nothing fragile is lost while you deal with what will keep:

This is why the first instinct of switching off an infected computer is often wrong. Isolating it from the network stops the damage, while keeping it powered on preserves what is in memory, which can include keys, running malicious code and network connections that never touched the disk.

Memory analysis versus disk analysis

Memory analysis looks at a snapshot of what was running: processes, their network connections, loaded code, sometimes passwords or encryption keys. It is powerful against attacks that live only in memory, but the snapshot has to be taken before shutdown and requires specialised tools. Disk analysis works on a bit-for-bit copy of the storage, called a forensic image: files, deleted data that can still be recovered, logs, browser history and persistence items. Investigators usually verify each image with a cryptographic hash, so anyone can later check that the copy has not changed.

Chain of custody

Chain of custody is the documented history of every piece of evidence: who collected it, when, how, where it was stored and who handled it since. NIST defines it as a process that tracks the movement of evidence through its collection, safeguarding and analysis lifecycle. In practice this is a form or a log that travels with the evidence. Without it, even a perfect analysis can be dismissed, because nobody can prove the evidence was not altered.

When to call professionals

• If the incident may lead to legal action, criminal charges or an insurance claim.
• If personal data of customers, students or patients may have been exposed.
• If you suspect a targeted attack against a journalist, activist or executive.

In those cases, the most valuable things you can do are to isolate, not wipe, and to write down everything you have already done. A clear record of your own actions is part of the evidence too.

What a network record adds

Investigators love an independent record of network activity, because an attacker on the machine cannot easily rewrite what another system already recorded. On a Mac, FireAI’s connection history shows which app contacted which address and when, and it is kept locally. It does not replace a forensic image, but it can quickly answer questions like “when did this app first contact that server?” and help decide which machines need a full investigation.