CompTIA Security+ (SY0-801)
Order of volatility in digital forensics: Security+ explained
Collect evidence from the most volatile source to the least volatile. On a live system NIST SP 800-86 says to collect network connections and login sessions first, then memory, running processes and open files, and network configuration and OS time last, before imaging the disk.
The order
SP 800-86 gives this order for volatile data: network connections, login sessions, contents of memory, running processes, open files, network configuration, operating system time. Network connections come first because they may time out or disconnect, and the users connected can change at any moment.
RFC 3227 gives a broader example order for a whole system: registers and cache; routing table, ARP cache, process table, kernel statistics and memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; archival media.
Memory and shutdown
Volatile data exists only on a live system that has not been rebooted or shut down. Powering off, or even disconnecting from the network, can destroy it. SP 800-86 gives the example that RAM may hold password hashes after a user runs encryption tools, so take a memory dump before shutdown.
A graceful shutdown cleans up temporary files and may let malware remove its traces. Pulling the power preserves swap and temporary files but can corrupt data on some systems.
Integrity and custody
Use a write-blocker so the imaging process cannot write to the original drive. Compute a message digest of the original before imaging and of the copy after, and compare them to prove the copy is identical.
When evidence may be used in legal or disciplinary proceedings, follow a chain of custody: log every person who held it, what they did and when, and store it securely. SP 800-61 Rev. 3 notes that most malware incidents never reach prosecution, so formal chain of custody may be skipped, but the collected data is still evidence and must be kept under the organization's preservation and retention procedures.
Where the exam catches people
- Believing memory is always collected first: in SP 800-86's order, network connections and login sessions come before memory.
- Believing you should power off a compromised machine at once: that destroys RAM, connections and sessions, so collect volatile data first.
- Believing a hash alone keeps the original drive unchanged: the write-blocker prevents writes, and the hash proves the copy matches.
- Believing evidence with no planned prosecution needs no handling rules: chain of custody may be skipped, but preservation still applies.