Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Evidence Preservation, Forensics and Chain of Custody
Assume it will be challenged
Incidents can end in court, in front of a regulator, in an insurance claim or at a disciplinary hearing. Evidence that was changed, mishandled or can’t be traced will be challenged, and may be thrown out. Handling it properly from the start keeps every option open.
Most fragile first
Evidence is collected in order of volatility: CPU registers and cache, memory, network state and running processes, then disks, then remote logs and archives. Pulling the plug wipes memory, which may hold encryption keys and attacker tools. Whether to power down is a decision for trained responders.
The forensic process
- Identify what evidence exists and where.
- Preserve it: isolate systems, capture volatile data.
- Acquire bit-by-bit images through write blockers, and verify them with matching hashes.
- Analyse copies, never the original.
- Document every step and tool, so the work can be repeated.
- Present clear, objective findings.
Chain of custody
The chain of custody records who collected, handled, transferred and stored each item of evidence, and when. Any gap gives the other side grounds to argue the evidence could have been altered.
Example. An investigator copies files from a suspect’s laptop to a USB stick and opens them to have a look. The access times change, and there’s no hash and no custody record. At the employment tribunal, the evidence is excluded. Forensic readiness training would have prevented it.
Forensic readiness
The security manager’s job isn’t to perform forensics, but to make sure the organisation is ready:
- Policy and procedures: when and how evidence is collected, and who may do it, following standards such as ISO/IEC 27037.
- Tools and logs: forensic tools, write blockers, enough log retention.
- People: trained internal responders, plus an external forensic retainer.
- Legal: privacy, employment law, cross-border data and legal privilege.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What to collect first from a running system | Volatile data such as memory |
| How to prove a copy is identical | Matching hash values |
| Record of who handled evidence | Chain of custody |
| Where analysis is performed | On a verified copy, not the original |
| The security manager’s role | Forensic readiness, and involving specialists |
In short
- Evidence is preserved from the start whenever legal action, regulatory reporting, insurance or disciplinary action is possible.
- Collect in order of volatility: memory and live state first, then disks, then logs and archives.
- Forensic images are bit-by-bit copies made through write blockers, verified with matching hashes; analysis is done on copies.
- Chain of custody records who collected, handled, transferred and stored each item, and when.
- Evidence handling must be lawful and follow documented procedures (e.g. ISO/IEC 27037) by qualified people.
- The security manager's role is forensic readiness: policies, tools, retainers and trained staff before an incident.
Exam traps
- Pulling the plug loses memory evidence; let trained responders decide.
- Analysing the original evidence, rather than a copy, can make it inadmissible.
- Any gap in the chain of custody gives the other side grounds to challenge evidence.
- Untrained staff 'having a look' often destroy the evidence they're trying to find.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Most fragile first
The forensic process
Chain of custody