Digital Forensics Fundamentals

Only a running host still holds decryption keys, decrypted mounted volumes, running processes and network state in memory. Power it off and an image of the same disk is ciphertext, or silent, for all of it.

A triage artefact set copies a chosen list of high-value host artefacts - event logs, execution and persistence records, scheduled tasks - instead of every sector of the disk. Minutes and megabytes per host rather than hours and terabytes, so it scales to hundreds of machines.

It ranks evidence by how fast it disappears, not by how useful it is. CPU registers and cache decay first, then RAM, then network state such as socket and ARP tables, then disk, then archived logs. Collect shortest-lived first.

Each entry names the item by a unique identifier, the date and time of the move, who released it, who received it, why it moved and where it went, signed by both parties. The point is that the item is never unaccounted for.

It proves the application returned that record to a session authenticated as that account. It does not prove a human read it, which human held the credential, or that the data was copied or kept.

A legal hold is a written directive to suspend routine deletion of material relevant to a dispute. The duty attaches when litigation is reasonably anticipated, usually well before any complaint, subpoena or regulator letter arrives.

Backdating. $STANDARD_INFORMATION times are settable through a documented Windows API; $FILE_NAME times are written by the NTFS driver on create, rename and move. $SI older than $FN points to timestomping, though a legitimate rename or restore can also diverge.

Deleting on NTFS only rewrites bookkeeping. The MFT record is flagged not-in-use, the directory index entry is removed, and the file's clusters are marked free in the volume bitmap. The bytes themselves stay on disk until something reuses those clusters.

No. A Shimcache (AppCompatCache) entry records that Windows' application-compatibility engine saw that file at that path with that last-modified time. Windows 8 and later store no execution flag at all, so an entry is evidence of existence, not of a run.

Only RAM holds running state: code that never touched disk, full process command lines, live network endpoints with their owning process id, decrypted data, and credential material such as hashes, Kerberos tickets and session keys held by lsass.

M is when the file's data was last written, A when it was last read, C when its MFT record's metadata last changed, and B (birth) when the file first appeared on that volume. C is not the creation time.

Hashing detects change only against an earlier trusted digest, and the acquisition hash is the first one there is. A write blocker is preventive: it keeps the source untouched so that first digest describes the disk as the intruder left it.

Yes. Spoliation is a failure to preserve, and intent is not required. Routine good-faith operation of a system excuses loss only before the duty attaches; afterwards, not suspending the job is itself the failure to take reasonable steps.

A persistence entry is configuration — an instruction to run later — so it proves nothing ran. Execution proof comes from a separate artefact: a Task Scheduler action-start record, a service state-change record, a Prefetch file for the payload, or a process-creation event.

Change nothing about power or session state: no lid, no lock, no logoff, no reboot. The mounted container's plaintext exists only while the machine stays as it is, so capture from external media first and log every step.

Read the address space, not the process list. Look for private committed regions marked executable with no file backing them, a PE header in anonymous memory, and threads starting outside every loaded module.

Convert every source to UTC, establishing each source's offset rather than assuming one. Keep every row's original value, source and applied offset, and derive those offsets from an anchor event two independent sources both captured.

Analysis writes: tools mount, index, carve and cache. The original is sealed so it can be re-read later, and work runs on a copy whose digest you matched to the acquisition digest. Verified is an act, not a label.

It leaves execution artefacts and consumes memory: a process-creation record, a Prefetch entry, a service installation, removable-media device records, loaded modules, and allocated pages that overwrite free memory. The goal is never a zero footprint, only a documented one.

When you believe the host is still under an intruder's control. A clean shutdown runs shutdown handlers and cleanup tasks - an execution opportunity for destructive code. A hard power cut freezes the stored state, at the cost of an unclean filesystem.

Because at 03:00 there is no time to design one. A standing profile has already been sized, tested against the estate and cleared with legal and privacy, so it can be pushed to hundreds of hosts immediately and every host returns a comparable set.

It proves which peer address a running process was connected to at the moment of capture, and in which direction the connection opened. A disk image never holds the kernel's connection table, which dies with the kernel.

Notes must name which copy you worked on, the tool and version, the exact steps and search terms, the time of each step, and every result including the ones that found nothing. Write them as you go, and keep observations separate from conclusions.

List the benign hypotheses first — a shared credential, an automation using the account's token, a mis-scoped report, a UI that prefetches every result — then find the observation that rules each one out.

Only that nothing is recoverable from those clusters. Free space carries no timestamps and no ownership, so it cannot say when it was overwritten, by whom, or whether anything was there. Restores and fresh virtual disks look identical.

A carved file is content with no context: no filename, no path, no owner, no filesystem timestamps. An intact MFT record keeps all of those bound to the data, so you can say where the file lived and when.

A $UsnJrnl entry proves a file with that name, under that parent directory, was created, written to or deleted at that time. It carries no content, no size, and no identity of whoever did it.

Prefetch is not universal. It is off by default on Windows Server, can be switched off by the EnablePrefetcher setting, has a fixed capacity that evicts old entries, and names files by executable name plus a path hash.

One list walks the kernel's doubly-linked list of process structures; the other scans physical memory for those structures directly. Scanning also finds processes unlinked from the list and remnants of processes that already exited, so it usually returns more.