Why a switched-off server loses evidence
Digital evidence is any data on a device that can show what happened, such as a log, a file or a running program. It is easy to spoil: switching a machine off, or opening a file the wrong way, can change or erase what you wanted to keep.
In this lesson you learn which evidence to collect first, and how to keep it so that other people can trust it.
By the end of this lesson
Note
I can collect digital evidence in a sensible order without changing it.
Key words
| Word | What it means |
|---|---|
| Digital forensics | finding and keeping evidence from computers so it can be checked |
| Volatile | data that is lost when the power goes off |
| Order of volatility | the order to collect evidence, the most fragile first |
| Working copy | a duplicate you examine instead of the original |
| Chain of custody | a written record of who held the evidence, and when |
| Write protected | set so that nobody can change it by accident |
The cells students fill in are left blank in this preview.
Some evidence vanishes when the power goes off
Memory (RAM) holds the programs that are running now. It is volatile: switch the machine off and it is gone. A file on the disk stays until somebody deletes or overwrites it.
So you collect in the order of volatility. The most fragile evidence comes first, and the most lasting comes last.
Worked example: the order of volatility
| Order | Evidence | How long it lasts |
|---|---|---|
| 1 | Memory (RAM) | Until the machine restarts |
| 2 | Network connections | Seconds to minutes |
| 3 | Running processes | Until they stop |
| 4 | Temporary files | Until a restart or a clean-up |
| 5 | Files on the disk | Until deleted or overwritten |
| 6 | Logs on another machine | Until the other machine rotates them |
| 7 | Backups and archives | Months or years |
The cells students fill in are left blank in this preview.
Never examine the original
Every time you open the original, you risk changing it. So you make a working copy and examine that. The original stays untouched, and anybody can go back to it.
In this lab the evidence in the folder case is already write protected. You will see that first, then copy it.
Who owns a file, and its mode
stat -c "%a %U" case/etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try to add a file to the evidence
touch case/etc/new.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Make a working copy
cp -rT --preserve=timestamps case workShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think that only looking at a file leaves it alone. But opening a file can change the time it was last opened, and some programs write to a file as they open it. Open a copy, never the original, and keep the original read only.
A chain of custody lists who held it
Evidence is only worth something if people believe it is the same as when you found it. The chain of custody is a written list: who had it, when, what they did and why.
Any gap in the list is a gap in the story. A court, a manager or a lecturer may ask you to fill it.
Worked example: a chain of custody record
| Time | Who | What was done | Fingerprint of the copy |
|---|---|---|---|
| 09:05 | R. Khan | Copied the shop server logs to a USB drive | 9f2c41ab |
| 09:40 | R. Khan | Gave the USB drive to J. Moore, who locked it away | 9f2c41ab |
| 14:10 | J. Moore | Made a working copy to examine | 9f2c41ab |
The cells students fill in are left blank in this preview.
Going further
Write the chain of custody for a laptop that you take from a desk at 10:00 and hand to a colleague at 10:20. List each person, each time and each action in a table. Then say what could go wrong if the 10:00 to 10:20 row is missing.