การเก็บรักษาหลักฐานและลำดับการควบคุมดูแล

During a breach, the instinct is to fix and move on. But if evidence is altered or lost, you cannot prove what happened, and any legal case collapses.

This lesson covers preserving evidence with a defensible chain of custody.

Some evidence vanishes faster than others. Collect the most volatile first.

• CPU registers and cache
• RAM and running processes
• Network connections
• Disk files
• Backups and logs (most durable)

Every command you run changes the system. Avoid rebooting a compromised host (RAM is lost) and prefer read-only collection tools. Document every action you take so investigators can separate attacker activity from responder activity.

Work from a bit-for-bit copy, never the original. Capture the full disk and, where possible, memory, so analysis never touches the source.

A cryptographic hash proves the image has not changed. Record it at collection time; anyone can re-hash later to verify integrity.

Chain of custody is an unbroken, documented record of who handled the evidence, when, why, and how it was stored. A single undocumented gap can render evidence inadmissible.

Log each transfer with timestamp, person, and purpose. Keep it append-only.

Store evidence with restricted access, encryption at rest, and write protection. Limit who can touch it and log every access. The fewer hands, the stronger the chain.

Forensic timelines depend on accurate clocks. Record the timezone, note any clock skew on the affected host, and reference an authoritative time source so events from different systems can be correlated.

Containment and evidence preservation can conflict: pulling a host offline stops the attacker but loses live state. The compromise is to capture volatile data first (memory, connections) and then isolate.

Putting it together when you detect a breach:

• Capture volatile data in order of volatility
• Image disks read-only and hash them
• Start a chain-of-custody log immediately
• Store securely with restricted access
• Then proceed with containment

Test your understanding of evidence preservation.

You learned to preserve digital evidence properly.

• Collect by order of volatility and avoid contamination
• Image read-only and hash for integrity
• Maintain an unbroken chain of custody
• Store securely and balance speed with preservation