9.3 Understand and Support Forensic Investigations

Why forensic support is on an operations exam

Knowledge area 4.2 — Understand and support forensic investigations — sits next to incident response because the same night you contain ransomware or an insider theft, someone will ask you to preserve evidence. The SSCP is usually the first responder or the handler who protects the scene for a forensic analyst, not a courtroom expert witness. The outline still expects you to know the legal tracks, how evidence is handled, how analysis is reported, and that organizational security policy still applies while you investigate.

The outline's bullets:

• Legal (civil, criminal, administrative) and ethical principles
• Evidence handling (first responder, triage, chain of custody, preservation of scene)
• Reporting of analysis
• Organization Security Policy Compliance

Legal tracks and ethical principles

The same laptop can generate three kinds of case. Handle the evidence so it can survive all three.

You are not counsel. Legal decides whether to call law enforcement, how to notify, and what is privileged. Your ethical duties — including the ISC2 canons: protect society and infrastructure, act honorably and legally, serve principals diligently, protect the profession — mean you do not plant evidence, do not browse mailboxes out of curiosity, do not lie in a timeline, and do not destroy logs because a manager is embarrassed.

Workplace searches are authorized by policy and law, not by curiosity. If the acceptable-use policy and login banner say company systems may be monitored, an administrative exam of a company laptop is usually on firmer ground than secretly cloning a personal phone. When in doubt, stop and ask legal. Crossing into a personal cloud account "because it was synced" is how you create a new incident. An administrative investigation that ignores those limits can taint a later criminal or civil case.

Evidence handling: first responder, triage, scene, chain of custody

First responder and preservation of scene

The first security or IT person to touch the system sets the quality of everything later. Preservation of scene means you treat the desk, the laptop, the USB drive, and the screen the way a physical investigator treats a room: you do not tidy up.

Scenario. A first responder is called to a cubicle: a manager's laptop is open, a USB stick is inserted, and Explorer shows a personal Dropbox folder filling with customers.csv. The manager is still at the keyboard.

Do:

• Identify yourself, stop further use, and do not let the manager "just finish this copy."
• Photograph the screen, cable layout, and USB device before you move anything.
• Note time, hostname, logged-in user, visible windows, and network (office LAN versus hotspot).
• Start a chain of custody form the moment you take control.
• Call the incident commander or forensic handler. If live response is required, leave the laptop powered on.

Do not:

• Power off immediately "to be safe" if volatile data (encryption keys in memory, open sessions, RAM-resident tools) still matters.
• Let help desk reimage so the manager can go to a trade show.
• Run antivirus "quick clean," defragment, or let the suspected person keep the USB "to show you later."
• Bag the laptop in a way that puts it in standby and then ignore it in a car trunk — know whether the device will sleep, encrypt, or wipe.

Triage and order of volatility

Triage decides live response versus powered-off collection, what to capture first, and whether business continuity (a loaner laptop) can proceed without touching the original.

Order of volatility is the exam's sequencing rule: capture the most perishable evidence first. Classic teaching (RFC 3227 and NIST SP 800-86) is:

Do not power off if live response is required. A full-disk encrypted laptop that is currently unlocked in RAM may become a brick of ciphertext when you hold the power button. Memory may hold the decryption key, the running malware, and the open Dropbox session. Live response: understand whether the malware is still exfiltrating, isolate the network (pull ethernet or disable Wi-Fi) at the right moment, capture RAM with a documented tool, then image disk through a write blocker. If policy and legal say the machine can be powered off — no live need, already off, or a simple lost-and-found drive — then follow the forensic procedure. Do not improvise a graceful shutdown that rewrites logs just because it feels polite.

Volatile-first is also why an administrator who "helps" by rebooting FILESERVER01 during ransomware can destroy the best evidence of the encryptor process. Containment can isolate a port without an immediate power-off. Coordinate with the forensic handler.

Chain of custody and hashing

Chain of custody is the written history of evidence: what it is, where it was, who had it, when they took it, why, and where it went next. A bag with a sticky note is not a chain. Gaps are how opposing counsel argues the USB was swapped.

Minimum fields: unique evidence ID, description (serial, hostname, asset tag), collection time and location, collector name and signature, hashes, storage location, every transfer (from whom, to whom, datetime, purpose), and condition.

Hashing evidence proves integrity. After imaging, compute a cryptographic hash (operations practice is SHA-256; older procedures still mention MD5) of the image and, where possible, of the original. Record the hash on the chain-of-custody form. Matching hashes later show the working copy was not altered. Hash before you analyze the working copy. Never hash after you "cleaned" the disk.

Use a write blocker for disk imaging so the act of collection does not modify the exhibit. Work on a copy. The original stays sealed under the chain. Hashing is not optional for "small" administrative cases. The USB with customers.csv can become a civil exhibit by Friday.

Reporting of analysis

A forensic report of analysis is a factual document: what was asked, what was collected (with hashes and times), methods and tools, findings, and limitations. It is not a novel about the manager's character.

Good reports:

• Separate facts (file customers.csv copied to volume serial … at 14:12, hash …) from interpretations (this is consistent with an unsanctioned copy).
• Include enough method that another examiner could repeat the work.
• State what you did not examine (personal phone, home PC).
• Avoid guilt language. Administrative and criminal decisions belong to HR, legal, and courts.

Bad reports: undated screenshots, no hashes, "obviously stolen," tools not named, working on the original disk. If you supported collection but did not perform analysis, say so. Do not pad a first-responder timeline into an expert opinion.

Organization security policy compliance

Forensics does not suspend policy. Organization Security Policy Compliance means the investigation itself must follow acceptable use, privacy, monitoring banners, data-classification handling, and authorization to use forensic tools.

Legal hold versus reimage is the scenario that fails administrators on both the exam and the job. Legal sends a hold: preserve the manager's laptop for a threatened lawsuit. The help desk wants to reimage so she can work the trade show. Reimaging wipes the exhibit (spoliation if a duty to preserve exists). The SSCP answer is: keep the original stored per forensic procedure (or imaged and then stored, if legal agrees the image is the preservation method), provide a loaner, and do not "refresh" the exhibit. Availability is solved with another device, not by destroying evidence.

The same conflict appears after malware: operations wants a clean image so the user is productive; legal wants the dirty disk. Image, hold the original, rebuild the user on new media. That satisfies both knowledge areas 4.1 recovery and 4.2 preservation.

When the CAT stem puts a running laptop in front of you, think volatile first, chain of custody, hash, and legal hold. When it offers "pull the plug immediately" as the only safe option, check whether live response is required. When it offers reimage as customer service, check for hold and for unsaved evidence. When it calls the matter "only administrative," still hash and still keep the chain.