# Digital Forensic Evidence Collection

> Chapter 11 of the Courseiva CYSA-PLUS curriculum — https://courseiva.com/learn/cysa-plus/forensic-evidence

**Official objective:** 3.3 — Incident Response

## Introduction

A critical process in incident response, digital forensic evidence collection is a key topic for the CompTIA CySA+ CS0-003 exam under Domain 3. Proper evidence collection is essential for preserving data integrity, ensuring admissibility in legal proceedings, and enabling accurate root cause analysis. Expect approximately 10-15% of exam questions to touch on forensic procedures, chain of custody, and evidence handling. This chapter will equip you with the precise steps, tools, and best practices needed to collect digital evidence effectively and in a forensically sound manner.

## Digital Forensics as a Crime Scene Investigation

A detective knows a crime scene is a fragile puzzle of evidence. The first thing they do is secure the perimeter and ensure no one enters or disturbs evidence. They then photograph the entire scene from multiple angles, create a detailed sketch, and label every piece of evidence. Each item is placed in a sterile bag, sealed, and logged in a chain-of-custody document. The detective cannot simply pick up a knife with bare hands—they must use gloves and tweezers to avoid contaminating DNA. Similarly, in digital forensics, you first isolate the system (e.g., by pulling the network cable or capturing memory) to prevent remote attackers from wiping data. You then create a bit-for-bit forensic image using a write blocker to ensure the original drive is never altered. The image is hashed (MD5/SHA-256) to prove integrity, just as a crime scene photo proves the original state. Every step is documented in a chain-of-custody log, including who handled the evidence, when, and what was done. If the detective mishandles the knife, the defense can argue the DNA evidence is tainted. Likewise, if a forensic analyst fails to follow proper procedure, the evidence can be thrown out in court. The analogy holds at every stage: preservation, collection, analysis, and presentation. Just as a detective must avoid introducing their own DNA, a forensic analyst must avoid altering the original data by working only on copies.

## Core explanation

### What is Digital Forensic Evidence Collection and Why It Exists

Digital forensic evidence collection is the process of identifying, preserving, and acquiring electronic data in a manner that maintains its integrity and admissibility. It is a foundational component of incident response (IR) and is governed by legal standards such as the Federal Rules of Evidence (FRE) in the U.S. and the ACPO (Association of Chief Police Officers) guidelines in the UK. The primary goals are to:
- Preserve the original data without alteration.
- Maintain a clear chain of custody.
- Ensure the evidence can be reproduced and verified.
- Support legal or disciplinary actions if necessary.

The CS0-003 exam expects you to know the order of volatility (OOV), which dictates that evidence must be collected from the most volatile (e.g., memory) to the least volatile (e.g., hard drives). This is because volatile data disappears when power is lost.

### Order of Volatility (OOV)

The order of volatility defines the sequence in which data should be collected based on its lifespan. The standard OOV from most to least volatile is:
- CPU registers and cache
- Routing tables, ARP cache, process table, kernel statistics
- Memory (RAM) — contains running processes, network connections, open files
- Temporary file systems (e.g., /tmp, swap)
- Disk (hard drives, SSDs)
- Remote logging and monitoring data
- Physical configuration and network topology
- Archival media (tapes, backups)

On the exam, you must know that memory (RAM) is collected before disk because it contains active processes and network connections that vanish upon shutdown. A common trap is collecting disk first, which would lose critical volatile data.

### Evidence Collection Procedures

#### 1. Preparation
Before any collection, you must have:
- Forensic toolkit (write blockers, forensic duplicators, cables, anti-static bags)
- Forensic software (FTK Imager, dd, Guymager, EnCase, X-Ways)
- Tamper-evident seals and evidence bags
- Chain-of-custody forms
- Camera for documentation
- Personal protective equipment (gloves, anti-static wrist strap)

#### 2. Securing the Scene
When you arrive at an incident, the first step is to secure the scene to prevent contamination. This includes:
- Isolating the system from the network (pull the Ethernet cable, disable Wi-Fi)
- Not shutting down the system if memory capture is needed
- Photographing the screen, connections, and environment
- Identifying all devices and cables
- Ensuring no unauthorized personnel touch the system

#### 3. Volatile Data Collection
Capture volatile data in order of volatility. Common commands on Linux/Windows:
- **Memory**: `dd if=/dev/mem` (Linux) or using FTK Imager, WinPmem, or LiME. Memory dump files are typically in raw (.raw, .mem) or crash dump format.
- **Process list**: `ps -aux` (Linux) or `tasklist /v` (Windows). Capture with timestamps.
- **Network connections**: `netstat -ano` (Windows) or `ss -tunap` (Linux).
- **ARP cache**: `arp -a`.
- **Routing table**: `route print` (Windows) or `ip route` (Linux).
- **Logged-in users**: `who` (Linux) or `query user` (Windows).
- **Open files**: `lsof` (Linux) or `handle` from Sysinternals (Windows).

All output should be saved to external media (USB drive) with a timestamp. Never save to the local disk as it may overwrite evidence.

#### 4. Non-Volatile Data Collection
This includes disk imaging, log files, and configuration files.

**Disk Imaging**:
- Use a write blocker to connect the suspect drive to a forensic workstation.
- Create a bit-for-bit copy (forensic image) using tools like:
  - `dd` (Linux): `dd if=/dev/sda of=/evidence/image.dd bs=4M conv=noerror,sync`
  - `dcfldd` (enhanced dd with hashing): `dcfldd if=/dev/sda hash=sha256 hashwindow=1G md5log=/evidence/hash.log of=/evidence/image.dd`
  - FTK Imager (Windows GUI)
  - Guymager (Linux GUI)
- The image should be in raw format (.dd, .img) or a compressed format like E01 (EnCase) or AFF (Advanced Forensic Format).
- After imaging, compute the hash (MD5 and SHA-256) of the original drive and the image file. They must match.

**Logical Collection**:
For live systems where you cannot take the entire disk, collect specific files:
- Event logs: `wevtutil epl System C:\evidence\system.evtx` (Windows)
- Registry hives: SAM, SYSTEM, SOFTWARE, NTUSER.DAT
- Browser history, prefetch files, $MFT (Master File Table)
- Application logs, firewall logs, IDS logs

#### 5. Chain of Custody
Chain of custody is a documented history that shows who handled the evidence, when, and for what purpose. It must include:
- Unique evidence identifier
- Description of the evidence (type, serial number, hash values)
- Date and time of collection
- Name and signature of the collector
- Every transfer: from, to, date, time, purpose
- Final disposition (e.g., returned to owner, destroyed, stored)

Any gap in the chain can render evidence inadmissible. The exam tests that you must document every transfer and that the evidence must be secured in a locked container when not in use.

### Write Blockers
A write blocker is a hardware or software device that prevents any write commands from reaching the source drive. Hardware write blockers connect between the drive and the forensic workstation. Software write blockers (e.g., `blkdiscard`, `blockdev --setro`) are less reliable because they can be bypassed. The exam emphasizes using hardware write blockers for forensic soundness.

### Hashing
Hashing is used to verify the integrity of evidence. Common algorithms:
- **MD5** (128-bit) — fast but deprecated due to collision attacks; still widely used.
- **SHA-1** (160-bit) — also deprecated for security but acceptable for integrity.
- **SHA-256** (256-bit) — recommended for forensic integrity.

You should compute hashes before and after imaging, and after each analysis step. The hash of the original drive and the image must match. If they differ, the evidence is compromised.

### Legal Considerations
- **Fourth Amendment** (U.S.): Search and seizure must be reasonable. If you are a private employee, you may have implied consent via company policy. If law enforcement, a warrant is usually required.
- **Electronic Communications Privacy Act (ECPA)**: Prohibits unauthorized access to stored communications.
- **GDPR** (EU): Requires data protection and may restrict cross-border transfer of evidence.
- **Computer Fraud and Abuse Act (CFAA)**: Unauthorized access is illegal.

The exam expects you to know that you need proper authorization (e.g., from management, legal, or a warrant) before collecting evidence.

### Forensic Tools
- **FTK Imager** (AccessData): Free, GUI-based, supports creating images of local drives, memory, and logical files.
- **EnCase** (Guidance Software): Commercial, widely used in law enforcement, supports E01 format.
- **dd/dcfldd** (Linux): Command-line, raw images, can hash on-the-fly.
- **Guymager** (Linux): GUI for dd/dcfldd, supports multiple formats.
- **Volatility**: Memory analysis framework for analyzing RAM dumps.
- **Autopsy**: GUI front-end for The Sleuth Kit (TSK), for disk analysis.
- **Wireshark**: For packet capture analysis.
- **tcpdump**: Command-line packet capture.

### Common Pitfalls
- **Shutting down the system before collecting memory**: Memory is lost. Always capture RAM first.
- **Not using a write blocker**: Alters the original drive, breaking the hash and potentially invalidating evidence.
- **Saving forensic data to the suspect drive**: Overwrites potential evidence.
- **Failing to document actions**: Gaps in chain of custody.
- **Using the original drive for analysis**: Always work on a copy.

### Interaction with Incident Response
Forensic collection is part of the IR process. During containment, you may need to collect evidence before eradicating the threat. If you collect evidence improperly, you may not be able to prosecute or understand the full scope. The IR team must balance speed with forensic soundness. In many cases, a live response (collecting volatile data) is done first, then the system is shut down for disk imaging.

### Summary
Digital forensic evidence collection is a meticulous process that must follow strict procedures to preserve data integrity and legal admissibility. The order of volatility dictates that you collect memory first, then disk. Use hardware write blockers, create bit-for-bit images, compute hashes, and maintain a chain of custody. The CS0-003 exam tests these concepts through scenario-based questions, often asking the correct order of steps or identifying improper actions.

## Real-world context

In a large enterprise environment, digital forensic evidence collection often occurs after a security breach is detected by the SOC. For example, a company might detect ransomware encrypting files on a server. The IR team jumps into action: they first isolate the server by pulling the network cable, then capture memory using a tool like WinPmem. They also collect netstat output and running processes. Meanwhile, a second team member photographs the server room and documents all connections. The server is then shut down, and the hard drives are removed and imaged using a hardware write blocker. The images are stored on a network-attached storage (NAS) with strict access controls. Chain-of-custody forms are signed by each team member and stored in a secure filing cabinet. This process ensures that if the company decides to pursue legal action against the attackers, the evidence will hold up in court.

Another common scenario is employee misconduct, such as data theft. The HR department requests a forensic examination of a laptop. The IT team must ensure that the employee is not alerted. They may perform a live forensic collection while the employee is in a meeting, capturing memory and active processes. Then they seize the laptop, image the drive, and analyze for exfiltration of sensitive files. In this case, the chain of custody is especially important because the evidence may be used in a termination hearing or lawsuit.

A third scenario involves cloud environments. Collecting evidence from virtual machines (VMs) in AWS or Azure requires different procedures. You may need to take a snapshot of the VM's disk, copy the memory from the hypervisor, and collect logs from CloudTrail or Azure Monitor. The order of volatility still applies, but you must work with the cloud provider's tools and APIs. Misconfigurations can lead to incomplete evidence, such as forgetting to enable memory capture before terminating the instance. In production, it's common to automate forensic collection using scripts that snapshot the disk and capture memory before shutting down the VM.

Performance considerations: Imaging a large drive (e.g., 4TB) can take hours. Use hardware that supports USB 3.0 or Thunderbolt for faster transfer. In time-sensitive incidents, you may perform a logical collection of key files first, then image the drive later. However, this risks missing hidden data. The exam expects you to know that full disk imaging is the gold standard.

When things go wrong: If a write blocker fails, the original drive may be corrupted, invalidating the evidence. If chain-of-custody forms are lost, the evidence may be excluded. If memory is not captured before shutdown, you lose all volatile data. These failures often lead to failed prosecutions or inability to fully remediate the incident.

## Exam focus

The CS0-003 exam tests digital forensic evidence collection under Domain 3 (Incident Response), Objective 3.3: "Explain the importance of digital forensic evidence collection." Expect scenario-based questions that ask you to identify the correct order of steps, proper tools, or legal considerations. Key areas:

1. **Order of Volatility (OOV)**: The exam will present a scenario where you must choose the correct sequence. Common wrong answer: collecting disk before memory. Remember: memory is most volatile, so it must be collected first.

2. **Write Blockers**: The exam asks whether to use a hardware or software write blocker. The correct answer is hardware, because software can be bypassed. Another trap: using a write blocker after imaging is useless—it must be used during imaging.

3. **Hashing**: Questions may ask which hash algorithm is recommended for forensic integrity. The exam accepts SHA-256 as the best answer, but MD5 is still common. Avoid SHA-1 due to known weaknesses. Also, know that hashing is done before and after imaging to verify integrity.

4. **Chain of Custody**: The exam tests that every transfer must be documented. A common wrong answer is that only the initial collector needs to sign. In reality, every handler must sign. Also, evidence must be secured in a locked container when not in use.

5. **Legal Authorization**: Questions may ask what is required before collecting evidence. The correct answer is proper authorization (e.g., warrant or management approval). A trap is assuming you can collect without authorization if you suspect wrongdoing.

6. **Live vs. Dead Acquisition**: The exam distinguishes between live (volatile data collected while system is running) and dead (disk imaging after shutdown). Live acquisition is necessary when you cannot afford downtime, but it may alter evidence slightly. The exam expects you to know that live acquisition is acceptable if done properly.

7. **Tools**: You may be asked which tool is used for memory capture (FTK Imager, WinPmem) or disk imaging (dd, EnCase). Know the primary use of each tool.

8. **Common Wrong Answers**: 
   - "Shut down the system first" — wrong, loses memory.
   - "Use the original drive for analysis" — wrong, must use a copy.
   - "Software write blocker is sufficient" — wrong, hardware is required for forensic soundness.
   - "Hash the image only after analysis" — wrong, hash must be computed immediately after imaging.

9. **Edge Cases**: The exam may ask about collecting evidence from a VM. The correct approach is to capture memory from the hypervisor and take a snapshot of the VM's disk. Another edge case: collecting evidence from a mobile device — you must use a Faraday bag to prevent remote wiping.

10. **Elimination Technique**: If a question asks about the first step in evidence collection, look for "secure the scene" or "isolate the system." If the option says "begin imaging the hard drive," it's likely wrong because volatile data must be collected first.

## Step by step

1. **Secure the Scene** — Upon arrival, immediately isolate the system from the network to prevent remote tampering. Unplug the Ethernet cable, disable Wi-Fi, and disconnect any external connections. Photograph the entire area, including the screen, cables, and all connected devices. Note the system state (running, off, asleep). Ensure no unauthorized personnel touch the system. This step preserves volatile evidence and prevents contamination.
2. **Collect Volatile Data** — Capture data in order of volatility. Start with memory (RAM) using a tool like FTK Imager or LiME. Then collect process lists, network connections, ARP cache, routing tables, logged-in users, and open files. Save all output to external media with timestamps. Do not save to the local disk. This step captures evidence that would be lost if the system is powered down.
3. **Capture Disk Image** — After volatile data collection, power down the system safely (if not already done). Remove the hard drive and connect it to a forensic workstation using a hardware write blocker. Use a tool like dd or FTK Imager to create a bit-for-bit image of the drive. Compute the hash (SHA-256) of the original drive and the image file. Verify they match. Store the original drive in an anti-static bag with tamper-evident seal.
4. **Document Chain of Custody** — Fill out a chain-of-custody form for each piece of evidence. Include a unique identifier, description, hash values, date/time of collection, collector's name and signature. Every time the evidence is transferred, log the date, time, from, to, and purpose. Secure evidence in a locked container. This documentation is critical for legal admissibility.
5. **Analyze Evidence on Copy** — Never analyze the original drive. Work exclusively on the forensic image. Mount the image as read-only. Use forensic tools like Autopsy or EnCase to examine file systems, recover deleted files, and analyze artifacts. Maintain a detailed log of all analysis actions. Compute hashes periodically to ensure the image has not been altered.

## Comparisons

### Live Acquisition vs Dead Acquisition

**Live Acquisition:**
- Collects volatile data (memory, processes) while system is running.
- May alter some data (e.g., memory pages, file access times).
- Used when system cannot be taken offline (e.g., critical servers).
- Requires special tools to minimize footprint (e.g., remote forensics).
- Captures evidence that would be lost on shutdown.

**Dead Acquisition:**
- Performed after system is shut down (power off).
- Does not alter the original disk (if write blocker is used).
- Used when system can be taken offline (e.g., seized laptop).
- Standard procedure for disk imaging and analysis.
- Cannot capture volatile data; memory is lost.

## Common misconceptions

- **Misconception:** You can collect evidence by simply copying files to a USB drive. **Reality:** Copying files alters file metadata (access time) and may miss hidden data. A bit-for-bit forensic image is required to preserve all data, including deleted files and unallocated space.
- **Misconception:** Software write blockers are as reliable as hardware write blockers. **Reality:** Software write blockers can be bypassed by the operating system or a rootkit. Hardware write blockers provide a physical barrier that ensures no write commands reach the drive, making them the forensic standard.
- **Misconception:** Once you have a forensic image, you can delete the original drive. **Reality:** The original drive must be preserved as evidence. The image is a copy, but the original may be required for court or further analysis. Always keep the original in a secure location.
- **Misconception:** Chain of custody is only needed if the case goes to court. **Reality:** Chain of custody should be maintained for every incident, even if legal action is not initially planned. It ensures evidence integrity and allows for future legal proceedings if needed.
- **Misconception:** RAM can be collected after shutting down the system. **Reality:** RAM is volatile and is lost when power is removed. It must be captured while the system is running. Shutting down first destroys this evidence.

## Key takeaways

- Order of volatility: memory first, then disk.
- Always use a hardware write blocker when imaging a drive.
- Compute hashes (SHA-256 recommended) before and after imaging to verify integrity.
- Maintain a chain-of-custody form for every piece of evidence, documenting every transfer.
- Never analyze the original drive; work on a forensic image.
- Secure the scene by isolating the system from the network before collecting evidence.
- Live acquisition captures volatile data; dead acquisition captures disk data after shutdown.
- Legal authorization (warrant or management approval) is required before collection.
- Document all actions with timestamps and photographs.
- Store evidence in a locked container with tamper-evident seals.

## FAQ

**What is the correct order of evidence collection according to the order of volatility?**

The correct order from most volatile to least volatile is: CPU registers/cache, routing tables/ARP cache/process table/kernel statistics, memory (RAM), temporary file systems, disk, remote logs, physical configuration, and archival media. On the CS0-003 exam, you need to know that memory is collected before disk. A common question asks what to collect first in a live system: the answer is memory.

**Why must a hardware write blocker be used instead of a software write blocker?**

A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original data is never altered. A software write blocker can be bypassed by the operating system, a rootkit, or a malicious process, especially on a compromised system. For forensic soundness and legal admissibility, hardware write blockers are required.

**What is the purpose of hashing in digital forensics?**

Hashing (using algorithms like MD5, SHA-1, or SHA-256) creates a unique digital fingerprint of data. It is used to verify the integrity of evidence by comparing the hash of the original drive to the hash of the forensic image. If they match, the image is an exact copy. Hashing is also done after analysis to ensure the image has not been tampered with.

**When should you perform a live acquisition versus a dead acquisition?**

Live acquisition is performed when the system must remain running (e.g., a production server that cannot be taken offline) and to capture volatile data like memory. Dead acquisition is performed after the system is shut down, typically for disk imaging. The choice depends on the situation: if you need memory, do live first; if you can take the system offline and need a pristine disk image, do dead acquisition with a write blocker.

**What information must be included in a chain-of-custody form?**

A chain-of-custody form must include: a unique evidence identifier, a description of the evidence (type, serial number, hash values), date and time of collection, name and signature of the collector, every transfer (from, to, date, time, purpose), and final disposition. Any gap in the chain can render the evidence inadmissible in court.

**Can you collect evidence from a virtual machine the same way as a physical machine?**

Collecting evidence from a VM involves similar principles but different methods. For volatile data, you can capture the VM's memory from the hypervisor (e.g., using VMware's snapshot feature). For disk, you can take a snapshot of the virtual disk and convert it to a forensic image. You must also collect hypervisor logs and network captures. The order of volatility still applies, but the tools differ.

**What should you do first when you arrive at a suspected compromised system?**

The first step is to secure the scene: isolate the system from the network by unplugging the Ethernet cable or disabling Wi-Fi to prevent remote tampering. Then photograph the system and its environment. After that, begin collecting volatile data starting with memory. Never shut down the system before capturing memory.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/cysa-plus/forensic-evidence