L15. Digital Forensics Basics
Course outlineLesson 15 of 20
Digital forensics is the practice of collecting, preserving, and analyzing digital evidence in a legally defensible manner. The Security+ exam tests your knowledge of the order of volatility, chain of custody, and forensic acquisition techniques.
Order of Volatility
When collecting evidence, always acquire the most volatile data first, because it is lost when the system is powered off or rebooted.
Order (most to least volatile):
- CPU registers and cache
- RAM (random access memory) and running processes
- Network connections, routing tables, ARP cache
- Running processes and open files
- Disk (hard drive, SSD)
- Removable media (USB, external drive)
- Backup and archival data (tapes, cloud backups)
Chain of Custody
Chain of custody is the documented trail showing who had access to evidence from collection through legal proceedings. Any gap in the chain can make evidence inadmissible in court.
Chain of custody documentation includes: who collected the evidence, when and where, who has handled it since, and how it was stored and transferred.
Forensic Acquisition
Write blockers: hardware or software devices that prevent any writes to the evidence drive during imaging. Mandatory for admissible forensic copies. Disk imaging: creating a bit-for-bit copy of the original drive using tools likedd, FTK Imager, or Autopsy. The image is verified with a hash (MD5 or SHA-256). If the hash of the image matches the original, integrity is confirmed.
Memory acquisition: tools like WinPmem, DumpIt, or Volatility capture a memory snapshot for analysis.
Legal Considerations
- A forensic investigator must have proper authorization (search warrant or employer authorization) before acquiring evidence
- Evidence must be acquired using forensically sound methods to be admissible
- Jurisdiction matters: cloud evidence stored in other countries may require additional legal processes
- ✓Order of volatility (most to least): CPU/cache, RAM, network state, disk, removable media, backups
- ✓Chain of custody documents who handled evidence at all times; any gap can make evidence inadmissible
- ✓Write blockers prevent any writes to evidence drives during acquisition, preserving integrity
- ✓Forensic disk images are hash-verified (SHA-256) to prove the copy is identical to the original
- ✓Memory forensics captures RAM to recover malware, credentials, and decrypted data that never touches disk
1. A forensic investigator arrives at an active incident. The server is still running. According to the order of volatility, what should they capture FIRST?
2. A forensic examiner creates a bit-for-bit copy of a suspect hard drive and generates an SHA-256 hash of both the original and the copy. The hashes match. What does this confirm?
3. What is the purpose of a write blocker in digital forensics?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.