CompTIA Security+ Preparation · lesson 32 of 45 · 25 min
What Is Digital Forensics?
Digital forensics is the process of collecting, preserving, analyzing, and presenting digital evidence in a manner that is legally admissible. It is used in incident response, criminal investigations, civil litigation, and internal investigations.
The Security+ exam tests the order of volatility, forensic acquisition methods, chain of custody, and key forensic concepts.
Order of Volatility
When collecting evidence, always collect the most volatile data first — it disappears fastest. The order of volatility (most to least volatile):
Forensic Acquisition
Write blockers are mandatory
Any write to evidence media — even the OS accessing the drive — can alter timestamps and overwrite deleted data. A write blocker ensures the acquisition process is forensically sound.
Key Forensic Concepts
Flashcard Drill
Order of volatility Collect most volatile data first: registers → RAM → network → processes → disk → logs → backups. Forensic image Bit-for-bit copy of storage media capturing all data including deleted files and slack space. Write blocker Device preventing writes to evidence media during acquisition — ensures forensic integrity. Chain of custody Documentation of everyone who handled evidence — required for legal admissibility. Legal hold Directive to preserve all relevant data — suspends deletion and overwrite policies. Hash verification MD5/SHA-256 hash before and after acquisition proves evidence was not altered. Steganography Hiding data within other files — e.g. concealing text inside an image file. Anti-forensics Techniques to destroy or hide evidence — log wiping, encryption, timestomping. Live acquisition Capturing RAM and running processes from a powered-on system before shutdown. Artifact Digital trace of activity — browser history, registry keys, event logs, prefetch files.
Scenario Practice
Evidence Collection Order
Power off the system immediately to preserve the hard drive. Capture RAM first (live acquisition) before powering off — fileless malware exists only in memory. Take photos of the screen and then reimage the hard drive. Disconnect the network cable and wait for IT to arrive. 1 Fileless malware lives in RAM — powering off destroys the evidence. The investigator must perform a live acquisition of RAM first, following the order of volatility. Only after capturing volatile data should the system be powered off for disk imaging.
Knowledge Check
Digital Forensics — 10 Questions
According to the order of volatility, which data should be collected first?
- Hard drive contents
- Backup tapes
- RAM and running processes
- Remote logs
Answer: RAM and running processes
RAM is highly volatile — lost when the system is powered off. Always collect volatile data first.
A write blocker is used to:
- Speed up disk imaging
- Prevent any writes to evidence media during acquisition
- Decrypt encrypted drives
- Recover deleted files
- Answer: Prevent any writes to evidence media during acquisition
Write blockers ensure no data is written to evidence media, preserving forensic integrity.
A logical copy captures deleted files and slack space just like a forensic bit-for-bit image.
- True
- False
Answer: False
A logical copy only captures active files. A forensic (bit-for-bit) image captures everything including deleted data and slack space.
Hiding secret data within an image or other file is called _____.
Answer: steganography
Steganography conceals data within other files — often used to exfiltrate data or hide communications.
Chain of custody documentation is required to:
- Speed up forensic analysis
- Ensure evidence is admissible in legal proceedings
- Automate evidence collection
- Classify incident severity
- Answer: Ensure evidence is admissible in legal proceedings
Chain of custody proves evidence integrity and admissibility — who handled it, when, and how. A legal hold directive requires an organization to:
- Delete all evidence immediately
- Preserve all relevant data and suspend normal deletion policies
- Encrypt all evidence
- Report the incident to law enforcement
- Answer: Preserve all relevant data and suspend normal deletion policies
A legal hold suspends normal data retention/deletion policies to preserve evidence for litigation.
Which are examples of digital artifacts? (Select all that apply)
- Browser history
- Registry keys
- Physical fingerprints
- Windows event logs
- Prefetch files
Answer: Browser history
Registry keys
- Windows event logs
- Prefetch files
Digital artifacts are electronic traces of activity. Physical fingerprints are physical evidence, not digital. Hash verification (MD5/SHA-256) of forensic evidence proves:
- The evidence is encrypted
- The evidence was not altered during or after acquisition
- The evidence is admissible in court
- The suspect is guilty
- Answer: The evidence was not altered during or after acquisition
Matching hashes before and after acquisition prove the evidence is an exact, unaltered copy.
Anti-forensics techniques are used by attackers to destroy or hide evidence of their activity.
- True
- False
Answer: True
Anti-forensics includes log wiping, encryption, timestomping, and file deletion to hinder forensic investigation.
Which acquisition method is required to capture fileless malware that runs entirely in memory?
- Forensic disk image
- Logical copy
- Live acquisition
- Backup restore
Answer: Live acquisition
Fileless malware exists only in RAM — live acquisition captures memory from a running system before it is lost on shutdown.
Previous lesson: Hardening techniques: patching, disabling services, secure baselines, CIS benchmarks
Back to CompTIA Security+ Preparation
Next lesson: Digital forensics: chain of custody, acquisition, analysis