17. Practice

25. All four activities

Best practices and common mistakes

Do

• Confirm your authority and its scope in writing before you start, and stop and ask if something outside that scope turns up.
• Plan the examination before you arrive: who is in charge, what questions you are answering, which order you will collect in, what kit you need, and what you will do if the machine is on and encrypted.
• Photograph and note everything before you touch anything, and find out who has already touched it.
• Leave a powered-off machine off. Capture memory from a powered-on machine before shutting it down, and isolate it physically first.
• Enumerate every storage layer on a live system and assume encryption is nested until shown otherwise.
• Collect in order of volatility. Take a physical image of every storage device through a tested write blocker.
• Use fault-tolerant acquisition for failing media and keep the map of unreadable ranges.
• Hash everything at the point of acquisition, verify every image, and re-verify before analysis.
• Work only from verified copies. Seal the originals.
• Reconstruct filesystem metadata before carving, and validate every reconstruction by structural decoding, corroboration and, where practical, independent reproduction.
• Retain fragments, rejected candidates and reconstruction records alongside every derived artefact.
• Grade every conclusion, label every statement, and report limitations and failures as carefully as successes.
• Keep a complete chain of custody for every item, physical or digital, and record your own actions contemporaneously, including mistakes.
• Escalate anything beyond your competence or equipment.

Do not

• Do not browse the user's files, email or messages on the original device.
• Do not power on a machine that was found off, and do not shut down a machine that was found on until volatile evidence is captured and the shutdown method is decided and recorded.
• Do not isolate a machine through its own user interface when a cable, a switch or shielding will do.
• Do not run chkdsk, fsck, automatic repair or any filesystem repair tool against evidential media, and do not mount an evidential volume read-write.
• Do not guess passwords or PINs on the original device, and do not attack the original evidence or the working image in place; attack extracted authentication material on separate hardware.
• Do not assume a rejected key is wrong before checking for header, offset and image corruption.
• Do not reboot, change firmware, boot or Secure Boot settings, disturb the TPM or Secure Enclave, or suspend, disable or modify encryption on an evidential machine; each can remove access to an unlocked volume permanently.
• Do not repeat a tool's output as an observed fact without checking it against the bytes or a second tool.
• Do not plug your own devices into evidence, or evidence into your everyday workstation without a write blocker.
• Do not treat a carved file that opens as a recovered file, and do not present a reconstruction as an original.
• Do not rely on a single copy, a single hash algorithm, a single tool or a single reconstruction method for a material finding.
• Do not let anyone outside the examination handle evidence, even to be helpful.
• Do not tidy up notes afterwards, and do not omit the attempts that failed.
• Do not state a conclusion more strongly than its weakest supporting evidence.

Why documenting every action matters

Every finding you present will be tested by someone whose job is to find the gap. Your notes are the answer to "how do you know?" for every step: how do you know the drive was not written to, how do you know the image is complete, how do you know those two fragments belong together, how do you know nobody touched the workstation overnight. If the answer is in your contemporaneous notes, with a time, a hash and a signature, the finding stands. If the answer is "I remember", or "it looked right", it may not.

Example. Two examiners recover the same image from the same fragments. One records the cluster ranges, the rejected candidates, the decoder output and the thumbnail comparison, and has a colleague reproduce the assembly. The other produces a file that opens and writes "image recovered from unallocated space". In the tribunal, the first examiner's exhibit is accepted after the opposing examiner repeats the work. The second spends an afternoon explaining why the file cannot be reproduced from the report, and the exhibit is given little weight.

26. Quick reference

Quick reference checklists

Print these. Tick each step as you do it, with the time.

On site: before you arrive

1. Written authority confirmed, scope understood, legal and HR contacts known.
2. Investigative questions written down.
3. Named person in charge of the scene agreed.
4. Kit checked: camera, notebook, evidence bags and seals, labels, write blocker (tested), imaging workstation with free space, memory capture tools on write-protected media with hashes pre-recorded, destination media for memory captures, Faraday bags or enclosure with filtered power, cables and adaptors, gloves, torch.
5. Account suspension coordinated with IT to happen when the scene is secured.

On site: preservation

6. Scene boundary declared; room locked or attended; entry and exit log started.
7. Nobody touches keyboards, mice, screens, cables or power.
8. Who has already interacted with the equipment established and recorded.
9. Power state of every device observed and recorded. Off stays off.
10. Reference clock chosen and recorded.
11. Wide, medium and close photographs of the scene and every device, including screens, cables, ports, peripherals, labels and serial numbers.
12. For each device: make, model, serial, power state, logged-in user, visible applications, connections, network state, encryption indicators, clock offset from reference.
13. Live machines isolated physically: Ethernet disconnected after photographing, hardware wireless switch or adaptor removal, RF shielding where justified. Method, time and expected footprint recorded.
14. Where several devices are present, triage order decided by volatility, risk of loss, value, encryption state and condition, and recorded.
15. Contemporaneous notes running from arrival: every action, time and reason.

On site: acquisition, in order of volatility

15. Memory captured from every powered-on device in scope, with tool, version, executable hash, command, start and finish times, source, destination, image hash and any errors recorded.
16. Encryption status and storage layout recorded from the live system with the platform's native commands, each recorded with its output; on Linux, the dm-crypt master key recorded with authority.
17. Nothing rebooted; no firmware, boot, Secure Boot, TPM, Secure Enclave or encryption settings changed.
18. Other volatile state collected with the minimum of additional commands, each recorded.
19. Logical copy of any unlocked encrypted volume taken and hashed.
20. Administrators asked to export and hash short-retention logs.
21. Shutdown method decided, reasons recorded, power removed or system shut down, time recorded.
22. Each storage device imaged physically through a tested write blocker; source and image hashes recorded; verification report kept.
23. Failing media imaged with a fault-tolerant tool; map file retained and hashed.
24. Phones kept isolated and charged; handed to a specialist unless you are trained and equipped.
25. Failures, partial acquisitions and escalations recorded with tool, version, error and time.

On site: custody and departure

25. Every item labelled with a unique evidence reference, including cables and adaptors, memory captures and map files.
26. Every physical item sealed in a tamper-evident bag; seal number, date, time and name recorded and photographed.
27. Chain of custody form started for every item with the first signature at the scene.
28. Evidence log reconciled against items in hand. Entry and exit log closed.
29. Evidence transported directly to secure storage and logged in; images copied to encrypted storage in two locations and hashes re-verified after copying.

Laboratory: examination

30. Master image hash verified; working copy made and verified; master not opened again.
31. Partition table parsed and compared with the disk; volumes located; encryption identified and recorded for each; every storage layer enumerated and nested containers, virtual disks and loop-backed filesystems listed.
32. Memory image searched for key material and mounted-volume information; every candidate recorded with offset and tool.
33. Legitimate recovery sources worked through with authority; each request and response recorded.
34. Password recovery, if authorised, run against extracted authentication material on separate hardware; configuration and outcome recorded, including failure.
35. Rejected keys tested against backup headers, alternative offsets and the unreadable-sector map before being reported as wrong.
36. Decryption performed to a new file; decrypted volume hashed and recorded as a derived artefact with key source and method.
37. Filesystem metadata examined and reconstructed from surviving copies before any carving; damage, orphans, journal entries and bitmap discrepancies recorded; no repair tool run, no read-write mount.
38. Deleted files recovered from surviving records first, with cluster reuse checked and recorded.
39. Data-hiding checks run: extension mismatches, entropy, partition gaps, alternate data streams and extended attributes, unusual permissions and mounts, appended data, steganography indicators.
40. Carving run on unallocated space with recorded tools and configuration; output treated as candidates, not results.
41. Fragmented files reconstructed using allocation evidence, markers, tables, structural decoding, thumbnails and EXIF; every source cluster, assembly order, method, decision, assumption and rejected candidate recorded; result hashed.
42. Each reconstruction validated by corroboration and, where practical, independent reproduction; fragments retained as exhibits.
43. Timestamps from every device normalised to UTC with the conversion and zone assumptions recorded; timeline assembled with clock offsets applied and each entry's source and status (observed, tool-reported or derived) marked.
44. Cross-device correlation performed against the hypotheses, with predicted artefacts found, missing or contradicted each recorded.
45. Every statement labelled (observed fact, tool-reported, interpretation, inference, recovered, reconstructed); every conclusion graded; limitations, failures, encrypted material not opened and disagreements between tools reported in the findings they affect.
46. Material findings peer-reviewed from the record before the report is issued.

Preservation stops the evidence changing. Acquisition copies it faithfully. Analysis reads the copy and says what it found and how sure it is. Documentation lets someone else check all three. Keep them in that order, stay within your authority, and the evidence will carry the weight it deserves and no more.