Skip to content
Irregularpedia Logo Irregularpedia

Digital Forensics

Digital Forensics

Section titled “Digital Forensics”

Digital forensics is the disciplined acquisition, preservation, and analysis of digital evidence such that conclusions are reproducible and the evidence survives scrutiny — in an incident review or a courtroom. The technical skills matter, but process is what separates forensics from “poking at a machine”: work on copies, document everything, and never alter the original.

Order of volatility and acquisition

Section titled “Order of volatility and acquisition”

Capture the most ephemeral evidence first. RAM, network connections, and running processes vanish on shutdown; disks persist. So acquire memory before pulling power, then image disks. Use a write blocker (hardware or software) when imaging so the act of reading cannot modify the source.

Disk imaging

Section titled “Disk imaging”

Make a bit-for-bit copy and verify it with a cryptographic hash so you can prove the working image equals the original:

Terminal window
# Image a source device to a file, logging progress (Linux)
dd if=/dev/sdX of=/evidence/case01.img bs=4M conv=noerror,sync status=progress


# Hash source and image — they must match
sha256sum /dev/sdX /evidence/case01.img

Forensic formats like E01 (Expert Witness Format, via ewfacquire/FTK Imager) add built-in hashing, compression, and case metadata, and are preferred over raw dd for real casework. Analyze the image, never the original.

Timeline analysis

Section titled “Timeline analysis”

A super timeline reconstructs what happened when by normalizing timestamps from the filesystem, logs, registry, browser history, and more into one sortable sequence. The standard tool is Plaso / log2timeline:

Terminal window
log2timeline.py --storage-file case01.plaso /evidence/case01.img
psort.py -w timeline.csv case01.plaso

Timelines are how you separate attacker activity from normal use and establish sequence of events. Beware timestamp tampering (anti-forensics) and timezone normalization.

Memory forensics

Section titled “Memory forensics”

RAM holds what disks don’t: running processes, injected code, network sockets, decrypted keys, and fileless malware. Analyze a memory image with Volatility 3 (or Rekall):

Terminal window
vol -f memory.raw windows.pslist        # running processes
vol -f memory.raw windows.netscan       # network connections
vol -f memory.raw windows.malfind       # injected/hidden code

Memory analysis frequently finds what disk analysis misses, which is why capturing RAM early (above) matters. Feed indicators you recover into Malware Analysis.

Chain of custody and admissibility

Section titled “Chain of custody and admissibility”

Evidence is only as good as the record proving it wasn’t altered:

  • Chain of custody — document who collected each item, when, from where, and every transfer/access since. A gap can render evidence inadmissible.
  • Integrity — hash on acquisition and re-verify before each analysis; record the hashes.
  • Reproducibility — use validated tools and document your steps so another examiner can reproduce the result.
  • Authorization — keep the legal basis (warrant, consent, employment policy) on file.

These same disciplines support incident response even when court isn’t the goal — good evidence handling makes root-cause analysis trustworthy.

Section titled “Related”