Last updated on 2024年9月6日

How do you store and retain forensic evidence?

由人工智能和领英社区提供技术支持

Forensic evidence is any data or information that can be used to support or refute a hypothesis or claim in an incident response investigation. Forensic evidence can include digital artifacts, such as files, logs, network traffic, memory dumps, or malware samples, as well as physical evidence, such as devices, documents, fingerprints, or DNA. Storing and retaining forensic evidence properly is crucial for ensuring its integrity, reliability, and admissibility in legal or regulatory proceedings. In this article, you will learn some best practices and guidelines for storing and retaining forensic evidence in the context of incident response.

此文章中的业界达人

由社区从 9 条内容中精选。了解更多

1 Identify the evidence sources

The first step in storing and retaining forensic evidence is to identify the sources and types of evidence that are relevant to the incident. Depending on the nature and scope of the incident, you may need to collect evidence from various sources, such as servers, workstations, mobile devices, cloud services, network devices, or external parties. You should also determine the types of evidence that are available and useful for the investigation, such as volatile (RAM, cache, etc.), persistent (hard disk, flash memory, etc.), or transient (network packets, logs, etc.) evidence. You should document the evidence sources and types in a detailed inventory or chain of custody form.

添加您的观点

Farukh Ismailov

Logistics Safety Engineer @ NCOC N.V. | IOSH MS | Risk Management | HSE Competency Assurance | Compliance
举报内容
Begin by cataloging evidence from diverse sources like servers, workstations, and network devices, distinguishing between volatile (RAM), persistent (hard drives), and transient (network logs) types. Detailed inventory and chain of custody documentation are essential to preserve evidence integrity and facilitate thorough analysis. This structured approach not only ensures comprehensive coverage but also upholds the credibility of the evidence for potential legal proceedings.

已翻译

赞

2 Acquire the evidence safely

The next step in storing and retaining forensic evidence is to acquire the evidence safely and securely. This means that you should follow the principles of forensic soundness, which are: minimizing the alteration of the original evidence, preserving the evidence in a consistent and verifiable manner, and documenting the evidence acquisition process and tools. You should use appropriate methods and tools for acquiring the evidence, depending on the source and type of evidence. For example, you may use live forensic tools for volatile evidence, disk imaging tools for persistent evidence, or packet capture tools for transient evidence. You should also use cryptographic hashes, such as MD5 or SHA-256, to verify the integrity of the acquired evidence.

添加您的观点

Farukh Ismailov

Logistics Safety Engineer @ NCOC N.V. | IOSH MS | Risk Management | HSE Competency Assurance | Compliance
举报内容
Use appropriate tools for each evidence type—live forensic tools for volatile data, disk imaging for persistent storage, and packet capture for transient information. Employ cryptographic hashes like MD5 or SHA-256 to verify evidence integrity. These practices safeguard the evidence’s validity, ensuring reliable and admissible findings while maintaining the credibility of the investigation.

已翻译

赞

3 Store the evidence securely

The third step in storing and retaining forensic evidence is to store the evidence securely and accessibly. This means that you should protect the evidence from unauthorized access, modification, deletion, or damage, while ensuring that you can access and analyze the evidence when needed. You should use appropriate media and formats for storing the evidence, depending on the size and type of evidence. For example, you may use optical discs, external hard drives, flash drives, or cloud storage for storing the evidence. You should also use encryption, password protection, or access control mechanisms to secure the stored evidence. You should label and catalog the stored evidence clearly and consistently.

添加您的观点

Masoumeh (Masi) Mousavi

Cybersecurity Specialist | Crypto & Cyber Crime Investigator | M.S. Cybersecurity Technology | CompTIA Security+
(已编辑)
举报内容
Forensic evidence is typically stored in secure and controlled environments, such as evidence lockers or storage facilities, to prevent contamination or tampering. It's important to use proper packaging, labeling, and chain of custody procedures to maintain integrity. Depending on the type of evidence, it may require specific conditions like temperature control or protection from light. Digital evidence is often stored on secure servers or specialized storage devices. Regular audits and documentation ensure accountability and adherence to protocols. Here are some common practices: 1. Secure Storage Facilities 2. Climate Control 3. Tamper-Evident Packaging 4. Chain of Custody 5. Digital Storage 6. Regular Inventory 7. Disposal

已翻译

赞
Tamera Cook

Western Regional Manager
举报内容
Don’t forget with your access control mechanisms to have reliable door hardware first and foremost to avoid tampering and unwanted bypasses of all the bells and whistles that go along with the overall solution

已翻译

赞
Kazem Fallahi

Cyber Security Analyst | Red Team | Threat Hunter | DFIR
举报内容
To securely store and retain forensic evidence: - Use encrypted storage media - Apply access controls like passwords - Ensure physical security - Label and catalog evidence clearly - Regularly monitor storage - Backup data for redundancy - Follow retention policies - Maintain a documented chain of custody

已翻译

赞
Dave Jercinovic M.S.

Hi
举报内容
First you disconnect from the network. Then power off. Then create a bitwise image… then go from there. Many options after that.

已翻译

赞
Farukh Ismailov

Logistics Safety Engineer @ NCOC N.V. | IOSH MS | Risk Management | HSE Competency Assurance | Compliance
举报内容
Choose suitable media—optical discs, external drives, or cloud storage—based on evidence size and type. Implement robust security measures, such as encryption, password protection, and access controls, to safeguard the evidence. Clear labeling and consistent cataloging are crucial for maintaining evidence integrity and facilitating retrieval. This approach ensures that evidence remains secure, verifiable, and ready for detailed investigation when needed.

已翻译

赞

4 Retain the evidence legally

The final step in storing and retaining forensic evidence is to retain the evidence legally and ethically. This means that you should comply with the applicable laws, regulations, policies, and standards for retaining the evidence, while respecting the privacy and confidentiality of the involved parties. You should determine the retention period and disposal method for the evidence, depending on the purpose and outcome of the investigation. For example, you may need to retain the evidence for a certain period of time for legal or regulatory reasons, or you may need to destroy the evidence after the investigation is closed. You should document the retention and disposal decisions and actions in a formal policy or procedure.

添加您的观点

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Ian MacLean Master Mariner LLM MBA AFNI

Available for marine cluster based short-term and/or projects (part time or full time), in addition to general marine consultancy/incident expertise in Singapore / APAC region. (Solicitor - non-practicing)
(已编辑)
举报内容
Why experts are so important: This is where your consulting engineers and metallurgists (the experts) come into their own. For example, if there has been a structural component failure, the English courts will expect that part to be preserved and provide an opportunity for a litigation opponent to inspect/analyse it in the same condition as the time of the incident. If destructive testing is required, opponents should be invited to witness this. Indeed if you go ahead without them, they may be able to apply to the court/tribunal to enforce their presence. Ideally, the experts on both sides should prepare an agreed testing protocol, agree a Testing House with each party have their own metallurgist present to witness the results.

已翻译

赞
John H. Upchurch [KCSP┃DUO Security Admin]

SEEKING: Identity & Access Management (IAM) | Risk Manager | SOC | IT Leader | KCS Knowledge Architect [15+ Years of combined EXPERIENCE: Cybersecurity ? Help Desk ? Desktop Support ? Networks ? Healthcare IT ? HigherEd]
举报内容
#??1??3?? ?? Host a Question and Answer session, plus tell a story, and add in some humor: Q: How did the hacker get in? A: Someone left their Windows open. Q: How did hacker get away? A: Used the backdoor and ransomware. Q: Why couldn't the witness identify the hacker? A: Used Spyware and Subnet Mask to hide identity. Q: How did the hacker get caught? A: CSIRT used a Bug, to lure in Scattered Spider, and they got stuck in the Web. A2: The CSIRT used Python to Byte...well, let's just say that a little bird (a.k.a. Parrot) did some squawking, but now they are done talking. Q: What happened to the hacker after getting caught? A: Police made them WannaCry by clearing their cookies. A2: FBI made their Heartbleed by deleting their cache.

已翻译

赞

Incident Response

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you store and retain forensic evidence?

1

2

3

4

5

1 Identify the evidence sources

2 Acquire the evidence safely

3 Store the evidence securely

4 Retain the evidence legally

5 Here’s what else to consider

Incident Response

给文章评分

感谢您的反馈

更多Incident Response相关文章

更多相关阅读内容