# Overview of Computer Forensics and Investigation Process

> Chapter 1 of the Courseiva EC-CHFI curriculum — https://courseiva.com/learn/ec-chfi/computer-forensics-fundamentals

**Official objective:** 1.1 — Understand the fundamental concepts of computer forensics and the investigation process.

## Introduction

Computer forensics is the disciplined process of collecting, preserving, analysing, and presenting digital evidence so that it is admissible in a court of law. For the EC-Council CHFI 312-49 exam, you must understand this process not as a vague concept but as a precise, repeatable methodology with strict rules about what an investigator can and cannot do at each stage. This chapter gives you the mental framework that every single forensic question on the exam depends on.

## The Police Crime Scene Investigation Analogy

A crime scene is a fragile collection of evidence that tells the story of an incident. The first officer on the scene does not immediately start picking up objects or questioning every witness. Instead, they secure the perimeter, photograph everything exactly as it was found, and carefully log each piece of evidence before moving a single item. That officer knows that one misplaced footprint or a single smudged fingerprint can destroy the entire case and let a guilty person walk free.

Computer forensics works exactly the same way. A hard drive or a server contains digital evidence — files, logs, emails, deleted data — that tells the story of a cyberattack or a policy violation. The forensic investigator is that first officer. They must never boot the suspect computer or open files directly on it because that act changes timestamps, overwrites deleted data, and corrupts evidence. Instead, they create a perfect bit-for-bit copy of the storage device using a write-blocker, then work only on that copy. The original drive is sealed in an evidence bag with a chain of custody log.

The entire investigation process follows this same principle: identify, preserve, analyse, document, and present. Each step has strict rules about what you can and cannot do, because the goal is not just to find the truth but to prove that truth in a court of law without any accusation of tampering. Just like a detective who photographs the body before moving it, a forensic investigator captures the system state before touching anything.

## Core explanation

Computer forensics, at its simplest, is the science of finding and preserving digital evidence in a way that stands up to legal scrutiny. The key word is 'science' — it follows a repeatable, documented process that can be audited and challenged in court. Before computer forensics existed, organisations dealt with computer incidents informally. If an employee was suspected of stealing files, a manager might simply log into their computer, look around, and fire them. That approach is useless in court because the evidence was never collected according to proper procedures. A lawyer would argue: 'How do we know the manager didn't plant those files? How do we know they didn't accidentally delete something?' Computer forensics eliminates those doubts.

The investigation process is usually broken down into five distinct phases: Identification, Preservation, Collection, Examination and Analysis, and Documentation and Presentation. Each phase has specific goals and rules.

Identification is the first step. The investigator must identify what potential sources of digital evidence exist. This could be the suspect's laptop, a network server, a USB drive, cloud storage, a mobile phone, or even a smart thermostat. In a corporate environment, the investigator works with IT staff to map out the network and list every device that might contain relevant data. The investigator also identifies the type of incident: is this a policy violation (an employee watching inappropriate videos), a criminal act (theft of intellectual property), or an external breach (a hacker gaining access)? The type of incident determines the scope of the investigation and the legal authority required.

Preservation is arguably the most critical phase. The entire forensic investigation is worthless if the evidence is altered between the moment of incident and the moment of analysis. The investigator must secure the scene. In the physical world, this means locking the office, placing guards at doors, and preventing anyone from touching the computer. In the digital world, preservation means creating a forensic image of every storage device using a write-blocker. A write-blocker is a hardware device or software tool that sits between the suspect drive and the forensic workstation. It allows data to be read but blocks any write commands. Without a write-blocker, simply connecting a drive to a normal computer can modify timestamps, change file metadata, and even overwrite deleted data. The investigator also calculates a cryptographic hash — a unique digital fingerprint — of the original drive and the image. If the two hashes match, it proves the image is an exact copy. This is called 'bit-for-bit' copying.

Collection involves physically or logically gathering the data from the identified sources. In many cases, collection and preservation happen together. The investigator removes hard drives from computers, bags them in anti-static evidence bags, and labels them with the chain of custody form. The chain of custody is a document that records every person who handled the evidence, the date and time, and what was done with it. This document proves that the evidence was not tampered with. If the chain is broken — for example, if an evidence bag is left unlocked overnight — the evidence can be thrown out of court.

Examination and Analysis is the phase where the investigator actually looks at the data. But this is done on the forensic image, never on the original. The investigator uses specialised forensic software such as EnCase, FTK (Forensic Toolkit), or Autopsy. These tools allow the investigator to search for deleted files, recover fragments of data from unallocated space, examine file metadata including creation and modification times, analyse internet history, search for specific keywords, and reconstruct user activity. The investigator must document every action they take — what tool was used, what search term was entered, what results were found. This documentation is crucial because a defence lawyer will ask: 'Did you run every possible search? Why did you stop at that point?' If the investigator has a complete log, they can answer those questions.

Documentation and Presentation is the final phase. The investigator produces a written report that explains what was found, how it was found, and why it is significant. The report must be written in plain language because it will be read by judges, juries, and lawyers who do not have technical backgrounds. The report also includes exhibits: printed screenshots, diagrams of network connections, timelines of file access, and the chain of custody forms. The investigator may be called to testify in court as an expert witness, explaining their methodology under oath. A single inconsistency in their testimony can destroy the entire case.

Why does this process exist? Because computers lie. Timestamps can be changed. Files can be renamed. Data can be intentionally deleted or encrypted. The forensic process is designed to overcome those challenges by following a scientific method that is transparent and repeatable. The CHFI exam tests your understanding of this process not as abstract theory but as actionable knowledge: what tool do you use at each step? What order must the steps happen in? What happens if you skip preservation and go straight to analysis? The answer is always that the evidence becomes inadmissible.

Before this structured process existed, digital investigations were ad hoc and unreliable. A system administrator might simply look at system logs and accuse someone. But logs can be altered by a knowledgeable insider. Modern computer forensics replaces guesswork with verifiable facts. Every hash can be recalculated. Every tool action is logged. Every piece of evidence is tracked. That is what makes it forensics, not just investigation.

## Real-world context

Consider a realistic scenario: a mid-sized financial services company called Meridian Finance. The head of compliance receives an anonymous tip that an employee in the accounts department, named Sarah, has been emailing customer credit card data to a personal Gmail account. Meridian has 500 employees, a standard Windows network, and an on-premises email server. The legal team approves a formal investigation.

Step one: The forensic investigator, a contractor called in for this case, meets with the IT manager. They identify all potential sources of evidence. These include:
- Sarah's company-issued laptop (a Dell Latitude running Windows 11)
- The Microsoft Exchange email server logs
- The network firewall logs showing outbound connections
- The company's backup tapes from the past 30 days
- Sarah's smartphone, which she uses for corporate email

The investigator documents this list and gets written approval from legal to seize the laptop and preserve the server logs.

Step two: Preservation. The investigator goes to Sarah's desk after she has been called to a meeting elsewhere. They photograph the desk exactly as it is. They disconnect the laptop without shutting it down normally — because normal shutdown writes data that could overwrite evidence. Instead, they pull the battery if possible, or hold the power button for a hard shutdown. Then they remove the solid-state drive (SSD) from the laptop, label it with a tamper-evident seal, and place it in an anti-static bag. Back in the lab, they connect the drive to a write-blocker and create a forensic image using FTK Imager. They calculate the SHA-256 hash of the original drive and compare it to the hash of the image. They match. The investigator also exports the email server logs from the Exchange server for the relevant date range, again using a write-blocker on the server's storage.

Step three: Collection. This phase is almost simultaneous with preservation here. The investigator also requests the network firewall logs from the IT team, who provide them in a raw log format. Each piece of evidence is added to the chain of custody log, signed by the investigator and the IT manager who witnessed the handover.

Step four: Examination and Analysis. The investigator mounts the forensic image in EnCase. They search for the Gmail address found in the anonymous tip. They find emails in Sarah's sent items folder with attachments containing CSV files with customer names and credit card numbers. They recover deleted copies of similar emails from the unallocated space of the drive. They examine file metadata and see that the CSV files were created on Sarah's laptop, not received from elsewhere. They also analyse internet history and see visits to the Gmail login page on multiple dates. They correlate the firewall logs showing outbound SMTP traffic from Sarah's machine IP address at the exact times of the email sends. The investigator creates a timeline in chart form showing each email send, each file creation, and each login.

Step five: Documentation and Presentation. The investigator writes a 20-page report. It includes:
- A summary of the incident
- The methodology used
- The chain of custody for every piece of evidence
- The search terms used and the results
- The timeline chart
- Screenshots of the incriminating emails and file metadata
- The hash values for every image

The report is reviewed by Meridian's legal team. Sarah is suspended pending a disciplinary hearing. The company decides not to pursue criminal charges because the total amount of data exfiltrated was small, but Sarah is fired for gross misconduct. If the company had pressed charges, the forensic report would be handed to the police, and the investigator would testify in court explaining exactly how they ensured the evidence was not tampered with.

In this real scenario, the forensic process turned a suspicion into a legally defensible case. Without it, Sarah could have claimed the emails were planted or that the IT manager accessed her account. The hash verification and chain of custody proved otherwise.

## Exam focus

The CHFI 312-49 exam dedicates significant attention to the investigation process framework. Expect multiple questions that test your knowledge of the exact order of phases and what happens in each. The exam loves to present a scenario where an investigator skips a step or does something out of order, and you must identify why that is wrong.

Concepts the exam tests repeatedly:
- The five phases of the forensic investigation process: Identification, Preservation, Collection, Examination and Analysis, Documentation and Presentation. You must memorise them in this exact order. The exam will sometimes rename a phase (for example, using 'Acquisition' instead of 'Collection') to confuse you. Learn the synonyms: 'Acquisition' and 'Collection' are interchangeable. 'Analysis' is sometimes lumped with 'Examination'.
- The definition and purpose of a write-blocker. The exam asks: what happens if you do not use a write-blocker? Answer: the operating system writes metadata to the drive, altering timestamps and potentially overwriting evidence. You must know that hardware write-blockers are preferred over software write-blockers because software write-blockers can be bypassed by a compromised operating system.
- Cryptographic hashing: the exam tests why we hash (to verify integrity of the image), which algorithms are acceptable (MD5, SHA-1, SHA-256), and the concept of hash collisions (extremely rare but possible; SHA-256 is considered collision-resistant). Expect a question asking why two different drives could have the same hash — the answer is a hash collision or a deliberate manipulation.
- Chain of custody: the exam tests what information must be on the form, who signs it, and what constitutes a break in the chain. A typical trap: 'If an investigator leaves evidence in an unlocked car overnight, is the chain broken?' Yes, because it was not secure. The exam will say 'the evidence was not tampered with' but still rule it inadmissible because the chain was broken.
- The difference between a forensic image (bit-for-bit copy of entire drive including deleted space) and a logical copy (only active files). The exam traps you by asking 'What should you use to preserve the entire evidence?' The correct answer is a forensic image, not a logical backup.
- Legal authority: the exam distinguishes between investigations with a warrant (criminal) and investigations with consent (corporate policy, civil). In a corporate environment, the company can investigate its own systems without a warrant if employees have signed an acceptable use policy stating no expectation of privacy.

Trap patterns to watch for:
- The question presents a situation where an investigator boots the suspect computer to examine it normally. The correct answer is always that this is improper because booting writes data to the drive. The only exception is when the computer is already running, and you must capture volatile data (RAM contents, running processes) before pulling the plug.
- The question says 'the investigator made a backup of the drive using the Windows copy command'. That is wrong — copy does not capture deleted files or slack space. The correct method is forensic imaging.
- The question asks about the 'first step' of an investigation. The exam often answers 'identification' but may also phrase it as 'scene preservation' or 'secure the scene'. Understand that 'identification' is the intellectual step (what are we looking for?), and 'preservation' is the physical step (lock the room, pull the plug). Both are early steps.
- Questions about order of volatility: when collecting live evidence, you must collect the most volatile data first (RAM, running processes, network connections) before less volatile data (hard drives). The exam tests this as a list: registers, cache, RAM, swap file, hard drive, tapes.
- Questions about expert witness testimony: the investigator can only testify about what they personally did and observed. They cannot testify about hearsay or about another investigator's work.

Key definitions to memorise for the exam:
- Forensic image: an exact bit-for-bit copy of a storage device, including all deleted files and unallocated space.
- Write-blocker: a device that prevents write commands from reaching the storage medium.
- Chain of custody: a chronological record of evidence handling, documenting every transfer, access, and storage condition.
- Hash: a fixed-length string generated by a mathematical algorithm that uniquely represents the contents of a file or drive.
- Order of volatility: the sequence in which digital evidence should be collected, from most volatile (RAM) to least volatile (archival backups).
- Expert witness: an individual with specialised knowledge who provides opinion testimony based on forensic evidence.

Common exam question types:
- Scenario-based multiple choice: 'An investigator wants to preserve a hard drive. What tool should they use?' Answer: a write-blocker and forensic imaging software.
- Ordering: 'Place the five phases in the correct order.'
- True/False: 'A logical backup of a drive is sufficient for forensic analysis.' False.
- Best practice questions: 'What should the investigator do first after arriving at the scene?' Answer: secure the scene and photograph it.

The exam is heavy on process and light on tools. You do not need to know how to operate EnCase, but you need to understand its purpose. Focus on the 'why' behind each step, not the 'how'.

## Step by step

1. **Identification** — The investigator identifies all potential sources of digital evidence relevant to the incident. This includes computers, servers, mobile devices, cloud accounts, network logs, and storage media. The investigator also determines the legal authority for the investigation — whether a warrant, consent, or company policy applies.
2. **Preservation** — The investigator secures the scene and prevents any changes to the evidence. This involves physically locking down the area, photographing the scene, and using write-blockers to create forensic images of all storage devices without altering them. Cryptographic hashes are calculated to verify image integrity, and the original drives are sealed in evidence bags.
3. **Collection** — The investigator physically or logically gathers the evidence from the identified sources. This includes removing hard drives, exporting server logs, capturing volatile data from RAM, and transferring forensic images to secure storage. Each piece of evidence is logged in the chain of custody with signatures and timestamps.
4. **Examination and Analysis** — The investigator examines the forensic images using specialised software like EnCase or FTK. They search for deleted files, recover fragments from unallocated space, analyse file metadata, review logs, and reconstruct user activity. All actions are logged to maintain transparency and repeatability.
5. **Documentation and Presentation** — The investigator compiles a detailed report summarising the findings, the methodology used, and the chain of custody. The report is written in plain language for non-technical audiences and includes exhibits such as screenshots, timelines, and hash values. The investigator may testify as an expert witness to explain the process under oath.

## Comparisons

### Forensic Image vs Logical Backup

**Forensic Image:**
- Captures every bit on the drive including deleted files and unallocated space
- Requires a write-blocker to prevent modification of original data
- Creates a hash to verify integrity of the copy against the original

**Logical Backup:**
- Only copies active files and file system structures
- Can be made with standard operating system tools like robocopy or backup software
- Does not capture deleted data or free space; not suitable for evidence

### Hardware Write-Blocker vs Software Write-Blocker

**Hardware Write-Blocker:**
- Physical device that sits between drive and computer; cannot be bypassed by software
- Compatible with all operating systems without driver conflicts
- Considered the gold standard for forensic acquisition

**Software Write-Blocker:**
- Software that intercepts write commands at the driver level
- Can be bypassed if the operating system is compromised or a different kernel module is loaded
- Not recommended for critical evidence because of potential failure points

### Volatile Data (RAM) vs Non-Volatile Data (Hard Drive)

**Volatile Data (RAM):**
- Lost immediately when computer is powered down
- Must be collected first following order of volatility
- Contains running processes, network connections, encryption keys

**Non-Volatile Data (Hard Drive):**
- Persists even after power is removed
- Collected after volatile data, using write-blocker
- Contains files, logs, user data, and deleted remnants

### Criminal Investigation (Warrant) vs Corporate Investigation (Consent)

**Criminal Investigation (Warrant):**
- Requires a search warrant signed by a judge specifying scope
- Evidence collected without warrant can be excluded under fourth amendment
- Law enforcement must adhere to strict procedural rules

**Corporate Investigation (Consent):**
- Based on employee signed acceptable use policy or corporate privacy agreement
- Company IT can search corporate devices without a warrant
- Evidence must still follow forensic best practices to be used in disciplinary hearings

## Diagram

_A flow diagram showing the five phases of the forensic investigation process, from incident occurrence to case resolution._

```mermaid
flowchart TD
    A[Incident Occurs] --> B[Identification: Find Evidence Sources]
    B --> C[Preservation: Secure Scene & Create Forensic Image]
    C --> D[Collection: Gather Evidence & Log Chain of Custody]
    D --> E[Examination & Analysis: Use Forensic Tools on Image]
    E --> F[Documentation & Presentation: Write Report & Testify]
    F --> G[Case Resolved: Evidence Admissible]
    style A fill:#f9f,stroke:#333,stroke-width:2px
    style G fill:#cfc,stroke:#333,stroke-width:2px
```

## Common misconceptions

- **Misconception:** You can just copy files from a suspect computer using a USB drive and that is valid evidence. **Reality:** Copying files with a regular copy command does not preserve metadata and does not capture deleted data or unallocated space. You must create a bit-for-bit forensic image using specialised hardware and software to preserve the complete state of the drive. (This mistake is common because most people's experience with computers involves copying files for personal use, where metadata is not important. They assume the same process works for evidence.)
- **Misconception:** If a computer is already turned on, you should shut it down normally before removing the hard drive. **Reality:** A normal shutdown writes data to the hard drive, overwriting potential evidence. Instead, you should pull the power cord or remove the battery to preserve the current state. In some cases, you may need to capture volatile data from RAM before powering down. (People are taught to shut computers down properly to avoid file corruption. But in forensics, preserving evidence takes priority over system health.)
- **Misconception:** A logical backup (like a Windows System Image) is acceptable for forensic analysis. **Reality:** A logical backup only copies active files and file systems, missing deleted files, slack space, and unallocated space that may contain crucial evidence. Forensic imaging captures every bit on the drive, including sectors marked as free space. (Many IT professionals are familiar with backups for disaster recovery, where only active files matter. They do not realise that deleted data can be recovered and is often the most important evidence.)
- **Misconception:** If you have a warrant, you can search any device at the crime scene without limitation. **Reality:** A warrant must specify the scope of the search. You cannot search devices owned by third parties or unrelated individuals without separate authorisation. Overbroad searches violate privacy laws and can lead to evidence suppression. (Pop culture depicts warrants as blanket permission to search everything. In reality, courts require specificity, and exceeding warrant scope is a common grounds for appeal.)
- **Misconception:** Hashing is optional; you can just trust that your forensic image is accurate. **Reality:** Hashing is mandatory. It provides a verifiable digital fingerprint that proves the image matches the original. Without it, a defence lawyer can argue that the image may have been altered during acquisition, and the evidence may be excluded. (Hashing seems like an extra step to beginners. They do not understand the adversarial nature of court: every assumption must be proved, and hashing is the simplest proof of integrity.)
- **Misconception:** Once evidence is collected, the chain of custody only matters if you intend to go to court. **Reality:** The chain of custody must be maintained from the moment of collection, regardless of whether the case goes to court. If it is broken, the evidence loses its evidentiary weight in any legal or disciplinary proceeding. You cannot retroactively fix a broken chain. (Beginners often think legal formalities only apply during trial preparation. In reality, forensic best practices apply from the first moment of seizure, because you never know when a case will escalate to litigation.)

## Key takeaways

- The five phases of the forensic investigation process in order are: Identification, Preservation, Collection, Examination and Analysis, and Documentation and Presentation.
- A forensic image is a bit-for-bit copy of a storage device that includes all data, including deleted files and unallocated space, unlike a logical backup which only captures active files.
- A write-blocker must be used whenever connecting a suspect drive to a forensic workstation to prevent any accidental writes that would alter evidence.
- Cryptographic hashing (using MD5, SHA-1, or SHA-256) is used to verify the integrity of the forensic image by comparing the hash of the original and the copy.
- The chain of custody documents every person who handled evidence, the date and time, and the purpose, ensuring the evidence can be traced and has not been tampered with.
- Volatile data, such as RAM contents and running processes, must be captured first because it is lost when the computer is powered down, following the order of volatility.
- In a corporate investigation, employees may have no expectation of privacy if they signed an acceptable use policy, allowing the company to investigate without a warrant.
- The investigator must document every action taken during analysis, including search terms and tool usage, to create a transparent and repeatable process that can survive cross-examination.

## FAQ

**What is the difference between a forensic image and a backup?**

A forensic image is a bit-for-bit copy of the entire storage device, including all deleted files, slack space, and unallocated sectors. A backup, like a Windows System Image or file-level copy, only captures active files and file system structures, missing potential evidence that may be hidden in unused space.

**Can I just use a USB stick to collect evidence from a suspect computer?**

No. Inserting a USB stick into a suspect computer writes data to the drive, altering timestamps and potentially overwriting evidence. You must remove the hard drive and connect it to a write-blocker before creating a forensic image.

**What is the chain of custody and why is it important?**

The chain of custody is a chronological document that records every person who handled the evidence, the dates and times, and what was done. It is crucial because it proves the evidence was not tampered with; if the chain is broken, the evidence can be ruled inadmissible in court.

**What is a write-blocker?**

A write-blocker is a hardware or software device that sits between the suspect storage drive and the forensic workstation. It allows the investigator to read data but blocks any write commands, preventing accidental changes to the evidence. Hardware write-blockers are preferred because they are more secure.

**What is the order of volatility in computer forensics?**

The order of volatility is the sequence in which digital evidence should be collected based on how quickly it can be lost. The most volatile data (CPU registers, cache, RAM, running processes) must be collected first, followed by less volatile data (swap files, hard drives, tapes). RAM is lost when the computer is powered down.

**Is it okay to boot a suspect computer to look at its contents?**

No. Booting a suspect computer writes temporary files, modifies timestamps, and alters the log files. You must always create a forensic image of the drive using a write-blocker and analyse that image on a separate forensic workstation.

## Check your understanding

1. **What is the first phase of the forensic investigation process according to the standard five-phase model?**

   Answer: Identification. The investigator must first identify potential sources of digital evidence and determine the legal authority for the investigation.

2. **Why must a write-blocker be used when connecting a suspect hard drive to a forensic workstation?**

   Answer: A write-blocker prevents any write commands from reaching the drive, thereby preserving the original state of the evidence and avoiding changes to timestamps or overwritten data.

3. **What is the purpose of cryptographic hashing in forensic imaging?**

   Answer: Hashing creates a unique digital fingerprint of the original drive and the forensic image. If both hashes match, it proves the image is an exact bit-for-bit copy and has not been altered.

4. **What information must be recorded on a chain of custody form?**

   Answer: The chain of custody form must record every person who handled the evidence, the date and time of each transfer, the purpose of handling, and the condition of the evidence.

5. **If a computer is already running when the investigator arrives, what should they do first?**

   Answer: They should capture volatile data (RAM contents, running processes, network connections) before powering down the system, because this data is lost on shutdown.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-chfi/computer-forensics-fundamentals