Chain of custody, order of volatility, disk imaging, file system artifacts, memory forensics, timeline analysis and anti-forensics.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is chain of custody?
Show answer
Continuous documentation of evidence handling, including who accessed it, when, where, and what actions were taken.- Why is chain of custody critical in digital forensics?
Show answer
It establishes the legitimacy of evidence and prevents allegations of tampering or contamination in legal proceedings.- What information must be documented in chain of custody?
Show answer
Who handled evidence, when, where, why, how, and what specific actions were taken during handling.- What is the consequence of a broken chain of custody?
Show answer
Evidence may be ruled inadmissible in court, potentially compromising the entire case.- What is the order of volatility?
Show answer
A ranking of evidence types by how quickly they disappear without preservation, from most volatile (registers) to least (disk).- What is the most volatile evidence in a running system?
Show answer
CPU registers and cache, which are lost in seconds when power is cut.- How long does RAM persist as evidence after power loss?
Show answer
Seconds to minutes depending on temperature; it must be acquired immediately before shutdown.- Where does disk storage rank in the order of volatility?
Show answer
Low volatility; data persists unless deliberately overwritten and should be acquired last in the priority sequence.- What is disk imaging?
Show answer
A bit-by-bit copy of an entire storage device, including deleted files, slack space, and unallocated clusters.- Why is a write-blocker used during disk imaging?
Show answer
To prevent any writes to the source drive and ensure the original evidence is not modified during the imaging process.- What hash functions are used to verify disk image integrity?
Show answer
MD5 and SHA-256; the hash of the image must match the hash of the source drive exactly.- Why is bit-by-bit imaging critical in disk forensics?
Show answer
It captures deleted files, slack space, unallocated space, and gaps between partitions that a normal file copy would miss.- What is a file system artifact?
Show answer
Evidence of past activity stored in file system structures, including deleted files, timestamps, and allocation tables.- How can deleted files be recovered from a disk image?
Show answer
The file system pointer is removed but data blocks remain; forensic tools scan unallocated space to find file signatures and reconstruct files.- What is the Master File Table (MFT) in NTFS?
Show answer
Metadata structure that records information about every file, including name, size, timestamps, permissions, and location.
FlashKeepers