4.2.1. Detection, Evidence Acquisition, and Chain of Custody
💡 First Principle: Evidence collected improperly is evidence that cannot be used — in court, in regulatory proceedings, or in disciplinary action. Chain of custody isn't paperwork; it's the mechanism that makes evidence legally defensible.
Detection and Analysis
IR begins when an indicator triggers investigation — either from a SIEM alert, user report, threat hunting finding, or external notification (law enforcement, ISAC, vendor). The first analysis phase answers: Is this a true incident? What systems are involved? What is the attacker's current activity?
Indicators of Compromise (IoCs) during detection:
- File hashes of known malicious executables
- IP addresses / domains used for C2
- Registry keys created for persistence
- User accounts created by the attacker
- Unusual processes or network connections
Evidence Acquisition
When an incident is confirmed, evidence must be collected before remediation — re-imaging or patching destroys forensic evidence. Evidence types and collection order (most volatile first):
| Evidence Type | Volatility | Collection Method |
|---|---|---|
| CPU registers / cache | Highest | Only if live forensics tooling in place |
| Running processes / network connections | Very high | EDR snapshot; netstat, ps, tasklist output |
| RAM (memory) | High | Memory acquisition tool (WinPmem, LiME for Linux) |
| Disk (running system) | Medium | Live/logical acquisition (e.g., FTK Imager live capture); full bit-for-bit imaging waits for power-off |
| Disk (powered off) | Low | Physical removal and imaging with write blocker |
| Logs (SIEM/centralized) | Low | Already centralized; query and export |
| External/backup media | Lowest | Preserve as-is |
Chain of Custody
Every piece of evidence collected during an incident must be tracked through a chain of custody:
- Collection: Who collected it, when, from what system, using what method
- Handling: Every person who had access, when, and why
- Storage: How evidence is stored (encrypted, write-protected, physically secured)
- Transfer: Documentation of every handoff
- Disposition: Final fate of evidence (returned, destroyed, archived)
Why it matters: if evidence is challenged in court or regulatory proceedings, gaps in chain of custody allow opposing parties to argue the evidence was tampered with, rendering it inadmissible.
Validating Data Integrity — Hash the evidence immediately upon collection (SHA-256 of disk image, memory dump, log export). Any subsequent analysis is performed on a copy; the original is preserved. If the hash of the original changes, the evidence was modified.
Legal Hold — When litigation or regulatory investigation is anticipated, a legal hold instructs relevant parties to preserve all potentially relevant data and halts normal data deletion schedules (like log rotation or email purging). IT and legal must coordinate to identify what data is in scope.
Preservation — Forensic copies must be stored in a way that prevents modification: write blockers for physical media, read-only mounts for disk images, access-controlled repositories with audit logs.
⚠️ Exam Trap: Chain of custody is not only relevant to criminal investigations. It applies to any incident where the evidence might support disciplinary action, civil litigation, insurance claims, or regulatory compliance reporting. Organizations that don't maintain chain of custody "because it's not a criminal matter" lose the ability to take formal action against insiders or seek insurance coverage.
Reflection Question: During an IR engagement, a junior analyst copies suspicious files from a compromised server to a USB drive, then analyzes them on a personal laptop. They find clear evidence of data theft. Why might this evidence be challenged, and what should the analyst have done instead?
