Midterm Study Guide

Laws
Fourth amendment protects against unreasonable searches and seizures, warrants require probable cause.
Fifth amendment: Protects individuals from self-incrimination
First amendment: Protects freedom of speech and press, influencing what counts as “press” in digital media.
Warrants: must specify probable cause, location and items.
Plain view doctrine: allows seizure of visible evidence during a lawful search.
Subpoenas: Used to compel evidence or appearance in court, can be quashed. Only the issuing court may quash a subpoena
Expert witnesses: specialists who can interpret technical or forensic evidence despite not witnessing the event.
Data Acquisition
Process of collecting, preserving and validating evidence from devices or storage media. The goal is to ensure that data is collected without alteration so it can be used in court.
Objectives​
​
Identify storage formats. Determine the best acquisition method, plan for contingencies, use appropriate tools, validate the data acquired, handle RAID systems and remote acquisitions.
Types of Data acquisitions
Static Acquisition
When the device is powered off, it prevents data modification and preserves original data, preferred whenever possible. Not possible with encrypted drives that only decrypt when running.
Live Acquisition
Performed when the system is running, used when disk encryption is active, the target is accessible only over a network. Captures RAM, active processes and volatile data.

Methods:
Disk-to-disk image file: bit for bit copy saved as one or more image files, FTK Imager, EnCase, ProDiscover.
Disk-to-disk: copies entire disk to another disk.
Logical acquisition: Captures specific files or types.
Sparse acquisition: Captures targeted files and fragments or deleted data.
Host Protected Area (HPA)
Hidden section of a drive not visible to the operating system
Used for system recovery or diagnostics.
Can be misused by attackers to hide data.
Not all tools capture HPA, so use hardware-level tools
Contingency planning
Always create two copies of each image using different tools or methods.
Capture the HPA if present. Store the original evidence securely work on copies.
Prepare for encryption issues BitLocker.
Data validation
Ensures integrity of collected data, done by generating hash values (MD5, SHA-1, SHA-256). If two hash values match the copy is identical to the original.
Digital evidence file formats
RAW (DD), Proprietary(E01) Advanced Forensic Format (AFF), SMART.
Imaging process
Use forensic tools to create a bit-for-bit image of the original disk.
Validate the image with hash comparison, never alter the original media. Some forensic software may miss hidden sectors or bad blocks, so redundancy is key.
RAID acquisitions
RAID combines multiple physical hard drives into a single logical unit to improve performance, redundancy, or both.
RAID = Redundant Array of Independent Disks
Used for redundancy, speed or both.
RAID 0 - Stripping, no redundancy
RAID 1 - Mirroring, redundancy
RAID 2-6 - Combine stripping with parity codes for recovery
Remote Network Acquisition
Used to collect evidence over a network when physical access is not possible
ProDiscover, R-Tools, F-Response
Memory Forensics
Examination of volatile data from a system’s RAM, it helps investigators recover evidence that disappears once a system is powered off.
Memory forensics, also called memory analysis, focuses on analyzing data stored in RAM.
Volatile data provides real-time evidence of what’s happening on a system.
Why is it important?
Some data exists only in memory and never touches the disk, making memory forensics crucial for cyber investigations.
​
Active network connections and session data.
Running processes and command history.
Encryption or decryption keys.
Chat messages, credentials, cookies, and other sensitive information.
Non-cached browser data, temporary decrypted files, or even credit card data.
Main Goal of memory forensics
Help investigators understand what’s happening, who’s doing it, and how.
Workflow
1.​ Acquire
2.​ Verify
3.​ Analyze
4.​ Report
Considerations in acquisition
Software-Based Acquisition
Local or remote
Physical access to target system, network configuration, cost and required memory dump format.
Risks during memory acquisition
Atomicity
Memory is always changing even when idle.
During acquisition, processes continue to write to memory, network connections update, and kernel structure shift.
Device memory risks
BIOS manages the physical memory map, labeling some regions as reserved for firmware or device memory.
When to acquire memory
Acquire memory from a running system only when necessary.
Avoid capturing memory during system startup, shutdown, maintenance or updates.
Local acquisition
Dump memory to an external USB, eSTA or FireWire drive.
Never save the dump to the target’s internal disk.
Always format external drives with high-performance file systems (NTFS)
Avoid reusing drives between infected systems.
Sterilize removable media before reuse.
Remote Acquisition
Push acquisition tools over the network and collect the dump remotely via netcat or similar tools. Secure transfer methods SSL TLS, with CryptCat, KnTDD or F-Reponse.
Block the outbound connections in the firewall to prevent malware exfiltration during the dump.
Physical memory dump is a snapshot of the entire RAM, captured in pages usually 4KB each.
Information recoverable from memory:​
Active processes and process trees.
Open files and sockets.
Network connections and buffered data.
Deleted files and live file carving.
Encryption keys, malware copies, and unencrypted documents.
User vs Kernel space
User memory
Contains application data, user credentials, runtime information.
Easier to interpret than physical memory - more structured.
Commonly holds plaintext passwords or unencrypted data.
Kernel Memory
Contains OS-level data structures.
Useful for detecting hidden processes or kernel-level rootkits.
Can help analyze system health and identify tampering.​
File Signature Analysis
Process of identifying a file’s true format by examining its binary header.
When the file signature matches its extension, it means the file type is consistent and can be opened normally.
Mismatch happens when the file’s extension does not match its internal signature — often done intentionally to hide or disguise files.
File signatures themselves can be tampered with, but forensic tools can often still detect inconsistencies. Every file contains metadata, information describing the file’s content, origin, and
system interactions.
How the OS Recognizes File Types
Applications like Microsoft Word or Adobe Reader also verify file headers to ensure the content matches the expected structure before opening.
If the header doesn’t match the extension, the application may:
Refuse to open the file.
Display a file corruption warning.
Windows Forensics
HDD Basics
Hard disk has spinning platters. Data sits in concentric tracks. Each track is cut into sectors. A common sector size is 512 bytes. A cluster is the allocation unit that the file system uses. A
cluster is one or more sectors. Larger clusters reduce metadata overhead but can waste space.
Cylinder is the stack of tracks that line up across all platters at the same radius. The old CHS idea multiplies cylinders, heads, and sectors to estimate capacity.
Zone bit recording lets outer tracks hold more sectors than inner tracks. Vendors group tracks into zones so each zone stores a similar total amount. This affects where data density and
performance vary across the platter.
SSD Basics
SSDs use flash memory cells. Cells have limited program and erase cycles. Wear leveling spreads writes across cells. Bad block management replaces weak blocks. When a user deletes
a file, the OS may send TRIM. Garbage collection inside the SSD later erases the underlying blocks. This can happen quickly or after hours or days. ​
Forensics impact: deleted content on SSD can disappear in a way that prevents recovery
Boot Sequence
Begins with firmware BIOS UEFI, performing a POST, locating bootable device, and executing the bootloader to load the OS.
File Systems
A file system manages how data is stored and retrieved. FAT (File allocation Table) and NTFS (New technology file system) are the main windows systems.
FAT
Created for floppy disks, evolved into FAT12, FAT16, FAT32, and exFAT.
File deletion: When deleted, the first character of the filename is replaced with 0xE5, and its clusters are marked as free—but data remains until overwritten.
Forensic tools can recover deleted data from FAT volumes.
NTFS
Uses 4KB clusters, supports journaling, compression, shadow copies, and encryption (EFS).
Stores everything (files, folders, metadata) as records in the Master File Table (MFT).
Resident files: Small files fully contained in the MFT.
Non-resident files: Large files stored in external clusters referenced by the MFT.
Automatic defragmentation and volume shadow copies can overwrite deleted data quickly.
Slack Space unused space within clusters after a file ends.
Divided into:
​ RAM slack and file slack.
Forensic relevance, slack may contain fragments of previously deleted files or sensitive data from memory. Data leakage, cross-program exposure, hidden data storage.
NTFS Features and Forensic Implications
Alternate Data Streams (ADS) storing multiple data streams in a single file, often abused to hide malicious files or secret data.
Encrypting File System (EFS): Public and private keys only original user or administrator with recovery keys can decrypt.
Deleting NTFS files: marks records as free, recovery is harder because NTFS quickly overwrites freed clusters.
Windows Registry hierarchical database storing configuration info for users, software and hardware.
HKCR file types and extensions
HKCU current user settings
HKLM System-wide settings
HKU User profiles
HKCC Current hardware configuration
Prefetch Files
Each prefetch file logs program execution details, timestamps and run counts.