证据保全与保管链
学习如何在安全事件期间正确保全数字证据，使其保持完整、可验证，并可用于调查或法律程序。
证据保全与保管链 是 CoddyKit 上的免费 Production Debugging & Incident Response Playbook 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Production Debugging & Incident Response Playbook 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Production Debugging & Incident Response Playbook 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Why Evidence Handling Matters
During a breach, the instinct is to fix and move on. But if evidence is altered or lost, you cannot prove what happened, and any legal case collapses.
This lesson covers preserving evidence with a defensible chain of custody.
Order of Volatility
Some evidence vanishes faster than others. Collect the most volatile first.
- CPU registers and cache
- RAM and running processes
- Network connections
- Disk files
- Backups and logs (most durable)
Don't Contaminate the Scene
Every command you run changes the system. Avoid rebooting a compromised host (RAM is lost) and prefer read-only collection tools. Document every action you take so investigators can separate attacker activity from responder activity.
Creating Forensic Images
Work from a bit-for-bit copy, never the original. Capture the full disk and, where possible, memory, so analysis never touches the source.
dd if=/dev/sda of=/evidence/host01.img bs=4M conv=noerror,syncHashing for Integrity
A cryptographic hash proves the image has not changed. Record it at collection time; anyone can re-hash later to verify integrity.
sha256sum /evidence/host01.img > host01.img.sha256What Chain of Custody Is
Chain of custody is an unbroken, documented record of who handled the evidence, when, why, and how it was stored. A single undocumented gap can render evidence inadmissible.
Recording Custody
Log each transfer with timestamp, person, and purpose. Keep it append-only.
2026-05-31 14:02 | A.Yilmaz | collected disk image from host01
2026-05-31 15:10 | A.Yilmaz -> B.Kaya | handed to analysis, sealedSecure Storage
Store evidence with restricted access, encryption at rest, and write protection. Limit who can touch it and log every access. The fewer hands, the stronger the chain.
Timestamps and Time Sync
Forensic timelines depend on accurate clocks. Record the timezone, note any clock skew on the affected host, and reference an authoritative time source so events from different systems can be correlated.
Balancing Speed and Preservation
Containment and evidence preservation can conflict: pulling a host offline stops the attacker but loses live state. The compromise is to capture volatile data first (memory, connections) and then isolate.
An Evidence Workflow
Putting it together when you detect a breach:
- Capture volatile data in order of volatility
- Image disks read-only and hash them
- Start a chain-of-custody log immediately
- Store securely with restricted access
- Then proceed with containment
Quick Check
Test your understanding of evidence preservation.
Recap
You learned to preserve digital evidence properly.
- Collect by order of volatility and avoid contamination
- Image read-only and hash for integrity
- Maintain an unbroken chain of custody
- Store securely and balance speed with preservation
常见问题解答
「证据保全与保管链」课时是免费的吗？
是的 — 「证据保全与保管链」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Production Debugging & Incident Response Playbook 课程的其余内容，请升级到 CoddyKit PRO。 Production Debugging & Incident Response Playbook 课程共包含 4 节课。
「证据保全与保管链」这节课中我会学到什么？
学习如何在安全事件期间正确保全数字证据，使其保持完整、可验证，并可用于调查或法律程序。 你通过在浏览器中直接运行的动手代码来练习 Production Debugging & Incident Response Playbook，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Production Debugging & Incident Response Playbook 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Production Debugging & Incident Response Playbook 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「证据保全与保管链」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Production Debugging & Incident Response Playbook 课中编写并运行代码吗？
能。每节 Production Debugging & Incident Response Playbook 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。