Cybersecurity Foundations (Grades 6–8) · lesson 40 of 48 · 8 min
Digital Evidence: Fragile, Fleeting, and Critical
When a security incident occurs, investigators need to answer four questions: What happened? When? How? Who? Answering these questions requires evidence — and digital evidence is uniquely fragile. Unlike physical evidence, it can be overwritten in seconds, altered without leaving visible traces, or destroyed simply by turning off a computer.
Understanding how digital evidence works — and how investigators build timelines from it — is foundational to both cybersecurity defence and forensic investigation. It also explains why the first actions you take after discovering an incident matter so much.
By the end of this lesson you will be able to explain the order of volatility, describe how attack timelines are built, understand chain of custody, and identify common sources of digital evidence.
Digital forensics in action
Digital forensics is the science of recovering and analysing digital evidence. It is used in criminal investigations, corporate incident response, and legal proceedings. Forensic investigators have recovered deleted files, reconstructed browsing history, and traced attacks back to specific individuals using evidence that the attacker thought was gone. The key: evidence must be collected correctly to be admissible and useful.
Why Evidence Matters in Cybersecurity
When a security incident occurs, investigators need to answer four questions: What happened? When? How? Who? Answering these questions requires evidence — and digital evidence is fragile. It can be overwritten, deleted, or altered if not handled carefully.
This lesson introduces the basics of digital evidence and how investigators build timelines to reconstruct what happened during an attack.
Types of Digital Evidence
Order of volatility
Forensic investigators collect evidence in order of volatility — most volatile first. RAM is collected before logs, logs before disk images. If you collect in the wrong order, the most fragile evidence is destroyed before it can be captured.
Building an Attack Timeline
An attack timeline is a chronological reconstruction of what happened during an incident. It answers: when did the attacker first gain access? What did they do? When were they detected? When were they removed?
Timelines are built by correlating timestamps from multiple sources — logs, emails, file metadata, and network captures — and arranging events in order.
Chain of Custody
In legal proceedings, digital evidence is only admissible if it can be proven that it was not tampered with. The chain of custody is a documented record of who collected evidence, when, how it was stored, and who had access to it.
Even in a school context, maintaining chain of custody matters — it ensures that evidence used in disciplinary proceedings is credible and defensible.
Knowledge Check
Evidence and Timelines
Why is RAM considered the most volatile type of digital evidence?
- It is the largest storage medium
- It is encrypted by default
- Its contents are lost when the computer loses power
- It is the hardest to access
Answer: Its contents are lost when the computer loses power
RAM holds running processes, open connections, and encryption keys — but only while the computer is on. Powering off destroys this evidence.
What is the purpose of collecting evidence in order of volatility?
- To save time
- To collect the most fragile evidence before it is lost
- To prioritise the most important evidence
- To comply with legal requirements
Answer: To collect the most fragile evidence before it is lost
Volatile evidence like RAM disappears quickly. Collecting it first ensures it is captured before it is overwritten or lost.
What does a chain of custody document prove?
- That the attacker is guilty
- That evidence was collected, stored, and handled without tampering
- That the incident was reported on time
- That the affected device was patched
Answer: That evidence was collected, stored, and handled without tampering
Chain of custody makes evidence admissible in legal or disciplinary proceedings by proving it was not altered after collection.
An attack timeline is built by correlating timestamps from a single log source.
- True
- False
Answer: False
Timelines are built by correlating timestamps from multiple sources — email logs, network logs, file metadata, authentication logs — to get a complete picture.
A _____ is a bit-for-bit copy of a storage device used for forensic analysis without touching the original evidence.
Answer: forensic image
Forensic images preserve the original device intact. Analysts work on the copy, so the original evidence remains unmodified.
Real-World Case Studies
Case 1: The BTK Killer — Caught by Digital Metadata
Dennis Rader, the BTK serial killer, evaded capture for 30 years. In 2005, he sent a floppy disk to police, believing it was untraceable. Forensic investigators found metadata embedded in a Microsoft Word document on the disk — it showed the document was last modified by “Dennis” and linked to a church in Wichita. Cross-referencing this with other evidence led directly to Rader’s arrest. The lesson: digital evidence leaves traces that users often do not know exist. Metadata in documents, photos, and files can be as revealing as the content itself.
Case 2: The Sony Pictures Hack — Building the Timeline
In 2014, attackers (attributed to North Korea) breached Sony Pictures and destroyed thousands of computers, leaked unreleased films, and published embarrassing emails. Forensic investigators built a detailed attack timeline by correlating logs from multiple systems: email servers showed when credentials were stolen, network logs showed lateral movement, and file system timestamps showed when data was exfiltrated. The timeline revealed the attackers had been inside Sony’s network for months before the destructive phase. The lesson: attack timelines built from multiple log sources reveal the full scope of an attack — not just the visible damage.
Previous lesson: Reading a security alert
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Safe log reading