5. Preservation, documentation
Evidence identification
Identifying evidence means deciding which devices and services could hold data bearing on the questions the investigation must answer. Write those questions down first. "Where could the material have gone, and what would show it going there?" produces one list; "when was this machine compromised and what did the attacker do?" produces another. The device inventory is the same; what matters on each device is not.
Desktop computers and workstations
Often the primary machine. Holds local files, browser history, email caches, USB connection records in the operating system logs and registry, and shadow copies or backups that may contain deleted or earlier material. Note whether the case has been opened; a drive may have been swapped or added. Workstations increasingly have more than one drive, and a small system drive plus a large data drive must both be imaged.
Laptops
Everything a workstation holds, plus mobility: wireless network history shows where the machine has been, and sleep or hibernation files can hold a copy of memory from an earlier moment. Laptops are the device most likely to have been used away from the office, so ask about home use, within the scope of your authority.
Smartphones
Photographs of screens and whiteboards, messaging apps, personal email, cloud storage apps and tethering records. A phone can be the channel through which data left without ever touching the corporate network. Corporate-owned phones are usually in scope; personal phones need specific legal advice.
External drives and USB devices
Collect every drive, stick, memory card and card reader in the area, including ones that look empty or personal. The device itself may be gone; the computer will still record that a device with a particular serial number was connected, and when.
Cloud storage and corporate systems
Personal cloud accounts signed into on a corporate machine leave sync folders, client databases and browser traces. On the corporate side, file servers, document management systems, source control, ticketing systems, endpoint management and data loss prevention tools all keep access logs that may need to be preserved before they roll over. Ask the administrators to export and hash those logs now.
Email, messaging and network evidence
- Email. Server-side mailboxes, including sent items, deleted items and forwarding rules.
- Messaging. Corporate platforms can be exported by an administrator; personal messaging depends on the phone.
- Network. Proxy and firewall logs, VPN logs, DNS records, DHCP leases and wireless controller logs show large transfers, connections to particular services and out-of-hours activity, and they are typically retained for a short time only.
Example. A desk holds a laptop, a phone and no USB devices. Do not conclude that nothing was ever connected. The laptop's system records will list every storage device connected to it, with make, serial number and first and last connection times, and that list is often where the investigation starts.
6. Preservation, acquisition
Prioritising evidence
You will not have time to do everything at once, and some evidence is disappearing while you stand there. Collect in order of volatility: the most short-lived first.
The order of volatility
- Registers, caches and the contents of physical memory on any powered-on device, including running processes, network connections and encryption keys.
- Other volatile system state: routing tables, ARP cache, logged-in sessions, open files, mounted volumes, temporary files and swap.
- Logs on network equipment and servers that overwrite themselves: firewall, proxy, VPN, wireless controller.
- Cloud and platform audit logs with short retention. Ask administrators to export these immediately.
- Storage that changes only when someone acts on it: internal drives, USB devices, backups.
- Archived and off-line material: old backups, printed documents.
Identify evidence at risk of loss or alteration
- Anything the user can still reach: accounts not yet suspended, a home machine, a personal cloud account with a sync client still running on a machine that has not been isolated.
- Anything on a timer: log rotation, retention policies, automatic deletion in messaging apps, a laptop battery.
- Anything physically fragile: a drive that clicks, a phone with a cracked screen and a low battery.
- Anything that depends on the current session: an unlocked encrypted volume, an open document, a decrypted mailbox.
Prioritise what bears on the investigative questions
Once volatile data is safe, focus on the artefact classes that answer the questions you wrote down. The same classes recur across most cases, weighted differently:
- Removable media activity. Operating system records of connected storage devices, with serial numbers and timestamps, and link files or recent-items lists that reveal filenames opened from those devices. Central to data-movement cases.
- File transfers and cloud sync. Uploads to file-sharing sites, large outbound emails, transfer client history, sync folders for personal accounts and sync client databases.
- Email and messages. Sent items with attachments, forwarding rules, drafts, and messages arranging or discussing the conduct in question.
- Program execution. Prefetch, shimcache, amcache, scheduled tasks, services and installed software. Central to malware and misuse cases: what ran, when, and from where.
- Documents and images. Copies in unexpected folders, renamed files, screenshots, photographs, print logs, and the files whose recovery is the object of the examination.
- Source code and repositories. Clones in unusual locations, pushes to unexpected remotes, archives of a codebase, and hosting platform access logs.
- Browser history. Sites visited, searches made, downloads, and sessions signed into personal services.
- Anti-forensic activity. Wiping tools, bulk deletions, timestamp manipulation, encryption applied shortly before a known date, and searches for how to do any of those.
Example. With an hour before the building closes, the right order is: capture memory on the running workstation; have IT export the short-retention platform logs; isolate and bag the phone; image the USB sticks found in the drawer; then take the workstation to the laboratory for full imaging. The workstation can wait once it is isolated and its memory is captured. The logs cannot.