3. Identifying and prioritising evidence

Before acquiring anything, decide what could hold the answers and what is disappearing fastest. Some evidence is vanishing while you stand there, and you will not have time to do everything at once.

The quick version

Write the investigative questions down first. They decide what matters on each device.
Collect every drive, stick and card in the area, including ones that look empty or personal.
Ask administrators to export and hash short-retention logs now, before they roll over.
Collect in order of volatility: memory and live state first, archives last.
Spot what is at risk: anything the user can still reach, anything on a timer, anything fragile, anything tied to the current session.

Open this when: you are standing in front of several devices and have to decide what to take, and in what order.

In this chapter

Evidence identification (section 5)
Prioritising evidence (section 6)

5. Preservation, documentation

Evidence identification

In short: decide which devices and services could hold data bearing on the questions the investigation must answer, and write those questions down first.

Start from the questions

Different questions produce different lists from the same device inventory.

"Where could the material have gone, and what would show it going there?" produces one list.
"When was this machine compromised and what did the attacker do?" produces another.

The devices are the same; what matters on each one is not.

Check each source

Source	What it holds	Watch for
Desktop computers and workstations	Often the primary machine. Local files, browser history, email caches, USB connection records in the operating system logs and registry, shadow copies or backups that may contain deleted or earlier material.	Whether the case has been opened; a drive may have been swapped or added. More than one drive is increasingly common: a small system drive and a large data drive must both be imaged.
Laptops	Everything a workstation holds, plus wireless network history showing where the machine has been, and sleep or hibernation files that can hold a copy of memory from an earlier moment.	Most likely to have been used away from the office, so ask about home use, within the scope of your authority.
Smartphones	Photographs of screens and whiteboards, messaging apps, personal email, cloud storage apps and tethering records.	A phone can be the channel through which data left without ever touching the corporate network. Corporate-owned phones are usually in scope; personal phones need specific legal advice.
External drives and USB devices	Every drive, stick, memory card and card reader in the area.	Collect ones that look empty or personal too. Even if the device is gone, the computer still records that a device with a particular serial number was connected, and when.
Cloud storage and corporate systems	Personal cloud accounts signed into on a corporate machine leave sync folders, client databases and browser traces. File servers, document management, source control, ticketing, endpoint management and data loss prevention tools all keep access logs.	Those logs may roll over. Ask the administrators to export and hash them now.

Cover email, messaging and the network

Email. Server-side mailboxes, including sent items, deleted items and forwarding rules.
Messaging. Corporate platforms can be exported by an administrator; personal messaging depends on the phone.
Network. Proxy and firewall logs, VPN logs, DNS records, DHCP leases and wireless controller logs show large transfers, connections to particular services and out-of-hours activity. They are typically retained for a short time only.

Example

A desk holds a laptop, a phone and no USB devices. Do not conclude that nothing was ever connected. The laptop's system records will list every storage device connected to it, with make, serial number and first and last connection times, and that list is often where the investigation starts.

Before you move on

Investigative questions written down.
Every device in the area listed, including every drive in a workstation.
Every drive, stick, card and reader collected.
Administrators asked to export and hash server, platform and network logs.
Legal advice sought for any personal phone.

6. Preservation, acquisition

Prioritising evidence

In short: collect in order of volatility, most short-lived first, then focus on what answers your questions.

Follow the order of volatility

Registers, caches and physical memory on any powered-on device, including running processes, network connections and encryption keys.
Other volatile system state: routing tables, ARP cache, logged-in sessions, open files, mounted volumes, temporary files and swap.
Self-overwriting logs on network equipment and servers: firewall, proxy, VPN, wireless controller.
Cloud and platform audit logs with short retention. Ask administrators to export these immediately.
Storage that changes only when someone acts on it: internal drives, USB devices, backups.
Archived and off-line material: old backups, printed documents.

Spot evidence at risk of loss or alteration

Anything the user can still reach: accounts not yet suspended, a home machine, a personal cloud account with a sync client still running on a machine that has not been isolated.
Anything on a timer: log rotation, retention policies, automatic deletion in messaging apps, a laptop battery.
Anything physically fragile: a drive that clicks, a phone with a cracked screen and a low battery.
Anything tied to the current session: an unlocked encrypted volume, an open document, a decrypted mailbox.

Focus on what answers the questions

Once volatile data is safe, go after the artefact classes that answer the questions you wrote down. The same classes recur across most cases, weighted differently:

Removable media activity. Operating system records of connected storage devices, with serial numbers and timestamps, and link files or recent-items lists that reveal filenames opened from those devices. Central to data-movement cases.
File transfers and cloud sync. Uploads to file-sharing sites, large outbound emails, transfer client history, sync folders for personal accounts and sync client databases.
Email and messages. Sent items with attachments, forwarding rules, drafts, and messages arranging or discussing the conduct in question.
Program execution. Prefetch, shimcache, amcache, scheduled tasks, services and installed software. Central to malware and misuse cases: what ran, when, and from where.
Documents and images. Copies in unexpected folders, renamed files, screenshots, photographs, print logs, and the files whose recovery is the object of the examination.
Source code and repositories. Clones in unusual locations, pushes to unexpected remotes, archives of a codebase, and hosting platform access logs.
Browser history. Sites visited, searches made, downloads, and sessions signed into personal services.
Anti-forensic activity. Wiping tools, bulk deletions, timestamp manipulation, encryption applied shortly before a known date, and searches for how to do any of those.

Example

With an hour before the building closes, the right order is:

Capture memory on the running workstation.
Have IT export the short-retention platform logs.
Isolate and bag the phone.
Image the USB sticks found in the drawer.
Take the workstation to the laboratory for full imaging.

The workstation can wait once it is isolated and its memory is captured. The logs cannot.

Before you move on

Memory and live state captured before anything slower.
Short-retention logs requested for immediate export.
Everything on a timer, fragile or session-bound flagged and handled first.
Artefact classes chosen to match the investigative questions.

← 2. The scene All chapters 4. Volatile evidence →

Back to the top of this chapter