Digital forensics and reporting is the structured process of collecting, analysing, and documenting evidence from computer systems after a cybersecurity incident. For the 200-201 exam, you need to understand how investigators gather digital clues and present them in a way that stands up in court or helps the company improve its defences. This skill is the difference between knowing something bad happened and proving exactly what occurred.
Jump to a section
A simple way to picture Forensics and Reporting
When you lose your wallet, the first thing you do is check your last known location — maybe the coffee shop where you paid for a coffee at 8:47 AM. That timestamp — 8:47 AM — is your first piece of digital evidence. You then retrace your steps: you walked from the counter to the window seat, you took out your phone, you placed the wallet on the table. Each action is like a digital log entry. The detective assigned to your case doesn't just guess — they look for fingerprints (like hashes), check the shop's CCTV (like network traffic captures), and interview witnesses (like user statements). After collecting all this, they write a formal police report that lists what happened, when, and who might be responsible. That report becomes the official record — just like a digital forensics report in cybersecurity. If the case goes to court, that report is what the judge relies on. In the same way, when a company gets hacked, the forensics team collects evidence (logs, files, system images), analyses it, and writes a detailed report. That report helps the company understand what went wrong, how to fix it, and — if needed — helps law enforcement prosecute the attackers. The whole process is about being precise, thorough, and organised, so no detail is missed.
Digital forensics is the application of investigative and analytical techniques to gather and preserve evidence from digital devices — computers, servers, smartphones, network logs — in a way that is admissible in a legal proceeding. The term 'forensics' comes from the Latin word 'forensis', meaning 'of the forum' (the ancient Roman court). So it's literally evidence for the courtroom, though in many corporate incidents the report is used internally to justify changes.
The process follows a strict methodology to ensure evidence is not tampered with. This is called the 'chain of custody' — a written record that tracks who handled the evidence, when, where, and what they did with it. If the chain of custody is broken, the evidence may be thrown out of court.
The core phases of digital forensics are:
Identification: recognising that an incident has occurred and what devices might contain evidence. For example, a server administrator sees unusual login attempts at 3:00 AM.
Preservation: isolating the systems to prevent evidence from being overwritten. This might involve taking a forensic image — a bit-for-bit copy of a hard drive — rather than working on the original.
Collection: gathering data from all relevant sources: hard drives, memory (RAM), network traffic logs, system logs, and email archives. Each piece of data has a hash — a unique digital fingerprint — computed so that if the file is ever altered, the hash changes.
Analysis: examining the collected data to find evidence of what happened. This could mean recovering deleted files, tracing IP addresses, or correlating timestamps across multiple logs.
Reporting: documenting the findings in a clear, detailed report that explains what was discovered, how it was discovered, and what it means. The report must be written so that a non-technical person — like a manager or a judge — can understand it.
A key concept is 'order of volatility'. This refers to the idea that some evidence disappears faster than others. For example, data in RAM (memory) is lost the moment the computer is turned off, while data on a hard drive remains. So investigators collect the most volatile data first: running processes, network connections, then memory, then hard drives.
Another critical term is 'timeline analysis'. This involves placing every event — logins, file changes, network connections — in chronological order to reconstruct the sequence of the attack. Timestamps are crucial, and investigators must verify that system clocks are accurate.
Finally, forensic tools are used extensively. Common tools include FTK Imager (for creating disk images), Autopsy (for analysing files), Wireshark (for examining network traffic), and Volatility (for analysing memory dumps). On the 200-201 exam, you won't need to use these tools, but you must understand what they do and why they are used.
Identification
The investigator identifies that an incident has occurred and which systems may hold relevant evidence. This step determines the scope of the investigation and what tools will be needed.
Preservation
The investigator isolates affected systems to prevent further tampering. This includes disconnecting from the network, placing a write-blocker on the storage device, and taking a forensic image. Preservation ensures the original evidence is unchanged.
Collection
The investigator gathers data from all relevant sources in the correct order of volatility. This includes memory dumps, network logs, event logs, and hard drive images. Each piece of data is hashed and logged in the chain of custody.
Analysis
The investigator examines the collected data using forensic tools. This involves timeline analysis, file carving (recovering deleted files), log correlation, and identifying indicators of compromise (IoCs). The goal is to understand exactly what happened.
Reporting
The investigator documents all findings in a formal report. The report includes an executive summary, a detailed technical section, a timeline of events, and recommendations. It is written for a non-technical audience and serves as the official record of the investigation.
Imagine you work as a junior cybersecurity analyst for a mid-size company called 'GreenTech Ltd'. You receive an alert from your security information and event management (SIEM) system: a user account named 'j.smith' has logged into the finance server at 3:00 AM, which is highly unusual. Your manager tells you to investigate and produce a forensics report.
Here is what you actually do, step by step:
First, you preserve the evidence. You immediately isolate the finance server from the network to prevent the attacker from deleting logs or covering their tracks. You notify the system administrator to make a forensic image of the hard drive using FTK Imager. The imaging process creates a file called 'finance_server.dd' and computes an MD5 hash — a 32-character string that uniquely identifies that image. You record this hash in a logbook along with the date, time, and your signature.
Next, you collect additional data. You export the Windows Security Event Log from the server, focusing on event ID 4624 (successful logon) and event ID 4634 (logoff). You also pull network logs from your firewall that show connections from the IP address 203.0.113.45 to the server at 3:00 AM. You note that this IP address is not in your company's allowed list.
Then comes analysis. You open the event log in a tool like Event Viewer or a specialised log analyser. You filter for 'j.smith' and see that the account logged in at 3:02 AM and logged off at 3:37 AM. During that window, you find event IDs 4656 (handle to an object was requested) for several sensitive financial spreadsheets. This suggests the attacker may have copied those files. You also check the 'j.smith' account — it turns out the password was never changed after a phishing email two weeks ago, which you find in a helpdesk ticket.
You build a timeline. You write down every event in chronological order:
2:59 AM: firewall logs show connection attempt from 203.0.113.45
3:02 AM: event log shows successful logon for j.smith
3:05 AM: file access event for 'Q4_earnings.xlsx'
3:37 AM: logoff event
3:38 AM: firewall logs show connection closed
Finally, you write the report. The report includes an executive summary (one page for managers), a detailed technical section (with all the logs and timestamps), and a conclusion recommending that the company implement multi-factor authentication and reset all compromised passwords. Your report becomes the official record that the company uses to justify security investments and, if they choose, to report the incident to law enforcement.
The 200-201 exam tests your understanding of the forensics process and reporting principles, not your ability to use forensic tools. Expect 5-8 questions on these topics, often in the 'Security Operations' domain.
Key exam topics include:
Order of volatility (OOV): You must know the order in which evidence should be collected. The standard order is: registers/cache, routing table, ARP cache, process table, kernel statistics, main memory (RAM), temporary file systems, and finally hard drives. The exam loves to ask 'What should the investigator collect first?' — the answer is always the most volatile (e.g., memory contents before hard drive).
Chain of custody: You will be asked why maintaining the chain of custody is important. The correct answer is 'to ensure evidence is admissible in court' or 'to prevent tampering'. A common trap is suggesting it's for 'performance' or 'ease of analysis'.
Hashing and integrity: The exam will ask what a hash is used for in forensics. Answer: to verify that a forensic image is an exact copy of the original and has not been altered. They may use terms like MD5, SHA-1, or SHA-256.
Types of evidence: You must distinguish between 'volatile data' (data that disappears when powered off, like RAM) and 'non-volatile data' (data that persists, like hard drive contents). Another distinction is 'best evidence' (the original) vs 'secondary evidence' (a copy or description).
Reporting standards: The exam expects you to know that a forensics report must be objective, detailed, and written in plain language for a non-technical audience. It must not include opinions or speculation — only factual findings.
Traps the exam sets:
They might describe a scenario where an analyst turns on a computer to look at files (which changes the evidence) and ask what went wrong. The correct answer is that the analyst should have created a forensic image first.
They might give you a list of items and ask which to collect first. The trap is ordering by importance rather than volatility. Always pick the most volatile item.
They might mention a 'raw disk image' vs a 'logical image' and ask which is better. The correct answer is a raw disk image because it captures deleted files and unallocated space.
Key definitions to memorise:
Forensic image: bit-for-bit copy of a storage device.
Hash: digital fingerprint of data; used to verify integrity.
Timeline analysis: ordering events chronologically to reconstruct an incident.
Digital forensics follows a strict process: Identification, Preservation, Collection, Analysis, and Reporting.
Order of volatility dictates that you must collect the most volatile evidence first, starting with memory and ending with hard drives.
Chain of custody is a documented trail that proves evidence has not been tampered with from collection to courtroom.
A forensic image is a bit-for-bit copy of a storage device, authenticated using a hash value.
Timeline analysis reconstructs the sequence of events by correlating timestamps from multiple log sources.
A forensics report must be objective, factual, and understandable to non-technical stakeholders.
Hashing is used to verify the integrity of evidence — any change to the data changes the hash.
Volatile data (like RAM contents) is lost when power is removed, so it must be collected before the system is shut down.
These come up on the exam all the time. Here's how to tell them apart.
Volatile Data
Data that is lost when power is removed (e.g., RAM contents)
Must be collected first in the order of volatility
Examples: running processes, network connections, system cache
Non-Volatile Data
Data that persists after power is removed (e.g., hard drive)
Collected after volatile data
Examples: files on disk, system logs, email archives
Forensic Image
Bit-for-bit copy of entire storage device
Captures deleted files and unallocated space
Verified with a hash to prove integrity
Logical File Copy
Copy of only active files
Does not recover deleted data
No integrity verification; timestamps may change
Best Evidence
The original evidence source (e.g., original hard drive)
Considered most reliable in court
Usually not used directly in analysis to avoid alteration
Secondary Evidence
A copy or description of the original
Admissible only if best evidence is unavailable
Must be proven to be an accurate copy via hash
Chain of Custody
Legal document tracking evidence handling
Includes dates, times, signatures of everyone who touched evidence
Required for evidence to be admissible in court
Incident Response Log
Operational log of incident response actions
Focuses on steps taken to contain and remediate
May not have the same legal rigor
Mistake
Forensics is only needed after a major data breach, like when credit card numbers are stolen.
Correct
Forensics is used for any security incident of significance — even a single unauthorised login or a suspicious email. Small incidents can be early indicators of a larger attack. Organisations use forensics to understand root causes and prevent recurrence, not just for court cases.
This misconception comes from TV shows that only show dramatic, large-scale hacks. In reality, most forensics work involves routine incidents like phishing or policy violations.
Mistake
You can just copy files from a computer by plugging in a USB drive and that's enough for evidence.
Correct
Copying files normally changes the 'last accessed' timestamp on the original file, which can alter evidence. Investigators must use write-blockers — hardware or software tools that prevent any data from being written to the original drive — and take a full forensic image. A simple file copy also misses deleted files and hidden data.
People are used to everyday file copying and assume it's sufficient. They don't understand that even a single 'read' operation can modify metadata.
Mistake
If you delete a file, it's gone forever and cannot be recovered.
Correct
Deleting a file typically removes the pointer to the data (the file's entry in the file system), but the actual data on the disk remains until it is overwritten. Forensic tools can recover 'deleted' files by scanning the unallocated space on the drive. The only way to ensure a file is truly gone is to use secure deletion methods that overwrite the data multiple times.
This belief persists because of how operating systems present deletion to users — the file disappears from the folder, so people assume it's gone. The underlying storage mechanism is not visible to them.
Mistake
A forensics report should be written like a technical guide for other analysts.
Correct
A forensics report must be written for a non-technical audience — managers, lawyers, or judges. It should include an executive summary, use plain language, explain technical terms, and present findings factually. It is not a step-by-step guide for IT staff.
Many beginners think the report's audience is other IT professionals because that's who they interact with. They forget that the report's purpose is often to support legal or business decisions.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A forensic image is a bit-for-bit copy of an entire storage device, including deleted files and unallocated space, while a backup typically only copies active files. Forensic images are used for evidence because they capture everything and are verified with a hash to ensure integrity.
Chain of custody is a documented record that tracks who handled evidence, when, and what they did with it. It is crucial because if the chain is broken, a court may rule the evidence inadmissible, potentially ruining the case.
Order of volatility refers to the sequence in which evidence should be collected based on how quickly it can be lost. The most volatile data (like CPU registers and RAM) should be collected first, and the least volatile (like hard drives) last.
Yes, often you can. Deleting a file usually only removes the pointer to the data, not the data itself. Forensic tools can recover files from unallocated space until that space is overwritten by new data.
A hash is a unique digital fingerprint of a file or disk image. It is used to verify that the evidence has not been altered — if the hash matches the original, the data is intact. Even one changed bit produces a completely different hash.
No, the exam does not test hands-on tool usage. However, you should understand what common tools do — for example, FTK Imager creates forensic images, and Wireshark captures network traffic.
You've finished Forensics and Reporting. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?