Digital Forensics Investigation Steps (workstation)

1. Preparation and Authorization

Before commencing any forensic activity, ensure the following prerequisites are met:

 Obtain written authorization from appropriate authorities (e.g., management, HR, or

legal department).

 Define a clear scope of investigation, specifying the systems, devices, or media

involved.

 Confirm compliance with organizational policies and legal regulations, including

privacy laws and evidence handling procedures.

2. Evidence Collection

Objective: Collect all relevant digital evidence while maintaining its integrity and preventing
alteration.

Steps:

 Secure the scene: Physically secure all systems, devices, and removable media to
prevent tampering or unauthorized access.

 Document everything: Record detailed notes and photographs of the scene, device
connections, running applications, and the surrounding environment before interacting
with any equipment.

 Create a chain of custody: Maintain a detailed log identifying who handled the
evidence, when, and for what purpose to ensure admissibility in court.

 Collect volatile data: Use live forensic tools (e.g., FTK Imager, EnCase, Volatility
Framework) to capture:

o Running processes

o Active network connections

o Logged-in sessions

o RAM contents

o Clipboard data

o System uptime and configuration

  Imaging storage: Create a bit-by-bit forensic image of all storage devices (e.g., hard
drives, removable media) using tools such as EnCase, FTK Imager, or dd (Linux).
Verify image integrity using cryptographic hash values (MD5, SHA-256).

3. Evidence Preservation

Objective: Maintain the integrity and authenticity of all collected evidence.

 Store original devices in tamper-evident evidence bags with proper labeling and seals.

 Preserve forensic images in secure, access-controlled storage.

 Record and verify hash values before and after analysis to ensure no modification
occurred.

 Use hardware write-blockers during imaging and analysis to prevent data alteration.

 Adhere to ISO/IEC 27037:2012 standards for proper digital evidence handling and
preservation.

4. Evidence Analysis

Objective: Identify potential policy violations, security breaches, or evidence of

unauthorized activities.

Analysis Steps:

 Timeline reconstruction: Examine system and event logs to reconstruct user

activities, including:

o Operating system logs (e.g., Windows Event Viewer)

o Application and security logs

o USB connection and access records

 File system examination: Investigate for:

o Recently modified or accessed files

o Deleted files and recoverable data

o Unauthorized document transfers or file copies

 Network activity analysis: Review browser history, VPN logs, and connection
records for:

o Unusual access patterns

 o Data transfers to cloud storage or external devices

o Connections to unrecognized IP addresses

 Removable media analysis: Inspect external storage for:

o Copies of sensitive or confidential files

o Unauthorized applications or utilities

o Indicators of data exfiltration

 Email and messaging analysis: Examine communication channels for:

o Suspicious or unauthorized correspondence

o Potential data sharing with external parties

 Geo-location and metadata analysis: Use metadata embedded in files, emails, or

logs to determine user activity patterns and possible locations at specific times.

5. Reporting

Objective: Present the investigation findings in a structured and legally defensible

manner.

The forensic report should include:

 A summary of the evidence collected

 A description of tools and methodologies used

 Analysis results and key findings

 Chain of custody documentation

 Identified policy violations or indicators of compromise

 Conclusions and recommendations for remediation or further action

 Forensic Investigation Plan (VIRUS)
1. Objective

To identify, collect, preserve, analyze, and interpret digital evidence from the affected
systems to determine the nature and source of the ransomware attack, establish the attack
chain, and support legal or disciplinary proceedings against the perpetrators.

2. Preparation and Authorization

 Obtain written authorization from management and relevant authorities to perform the
forensic investigation.
 Define the scope of investigation, including affected servers, employee workstations,
backup storage, and network infrastructure.
 Ensure compliance with applicable cybersecurity and data protection laws, along with
ISO/IEC 27037:2012 standards for digital evidence handling.
 Prepare all necessary forensic tools, imaging devices, and write-blockers for evidence
acquisition.

3. Incident Response and Scene Security

 Isolate infected systems to prevent further propagation of the ransomware.

 Avoid shutting down any system that may contain volatile evidence (RAM, running
processes, open connections).
 Document the scene:
o Record and photograph system configurations, connected devices, and
network topology.
o Note running processes, open applications, displayed ransom notes, and
logged-in sessions.
 Preserve volatile data using live forensic tools such as FTK Imager, Magnet RAM
Capture, or the Volatility Framework.
4. Evidence Acquisition

Objective: Collect digital evidence in a forensically sound manner without altering the
original data.

Steps:

 Volatile Data Acquisition:

o Capture RAM to extract encryption keys, running processes, and active
malware payloads.
o Use tools such as FTK Imager, Belkasoft Live RAM Capturer, or DumpIt.
 Non-Volatile Data Imaging:
o Create bit-by-bit forensic images of compromised servers, workstations, and
backup drives using EnCase, FTK, or dd (Linux).
o Use write-blockers to maintain data integrity.
o Compute and record cryptographic hash values (e.g., MD5, SHA-256) for
verification.
 Network Evidence Collection:
o Collect firewall logs, VPN logs, proxy logs, and IDS/IPS alerts.
o Capture network flow data to trace communication with external IP addresses
or command-and-control servers.
 Email and Phishing Evidence:
o Retrieve the phishing email or malicious link that triggered the attack.
o Collect associated email headers, attachments, and embedded URLs for
detailed analysis.

5. Evidence Preservation

 Store original storage devices in tamper-evident evidence bags with proper labeling.
 Maintain chain of custody documentation recording handlers, transfer dates, and
purposes.
  Keep forensic images and log files in secure, access-controlled storage.
 Periodically verify integrity by recalculating and matching stored hash values.

6. Evidence Analysis and Interpretation

Objective: Identify the attack vector, analyze the ransomware behavior, and trace the
attacker.

a. Timeline Reconstruction

 Analyze system and event logs to reconstruct the sequence of events — from the
initial phishing attempt to execution and encryption.
 Identify timestamps of the first encryption activity, privilege escalation, and lateral
movement.

b. Malware Analysis

 Static Analysis:
o Examine ransomware executables in an isolated sandbox using IDA Pro,
Ghidra, or PEiD.
o Identify targeted file types, encryption algorithms, and persistence
mechanisms.
 Dynamic Analysis:
o Execute the malware in a controlled environment (e.g., Cuckoo Sandbox) to
observe behavior.
o Capture network communications to detect connections with command-and-
control or cryptocurrency servers.

c. Network Forensics

 Correlate firewall, proxy, and IDS/IPS logs to detect suspicious outbound traffic.
 Use tools such as Wireshark or NetworkMiner to identify data exfiltration or lateral
movement.
  Analyze connections involving anonymization networks (e.g., TOR) or
cryptocurrency wallet transactions.

d. Email Forensics

 Examine phishing emails using tools such as MxToolbox or Forensic Email

Collector to identify sender domains, IP origins, and SPF/DKIM authentication
results.
 Check malicious attachments or URLs using VirusTotal and [Link] for threat
intelligence correlation.

e. File System and Backup Analysis

 Identify encrypted or newly modified files and ransom notes.

 Use Autopsy or EnCase to recover deleted files, logs, and configuration data.
 Examine backup systems to determine whether alteration or deletion occurred
manually or through automated ransomware scripts.

f. Attribution and Link Analysis

 Cross-reference malware hashes, IPs, and wallet addresses with threat intelligence
databases (e.g., MITRE ATT&CK, VirusTotal, Hybrid Analysis).
 Identify similarities to known ransomware families or campaigns.

g. Legal Assessment

 Based on the evidence (logs, network traces, malware artifacts, and email analysis),
assess whether the activity constitutes a cybercrime under relevant digital laws (e.g.,
unauthorized access, data modification, or extortion).
 Determine the involvement of internal or external entities to support further legal
action or clearance.

7. Reporting

 Prepare a comprehensive forensic investigation report that includes:

 o Summary of the incident and impacted assets.
o Detailed methods and tools used for acquisition and analysis.
o Chain of custody documentation.
o Key findings with supporting evidence and timestamps.
o Conclusions and recommendations for system security improvements and
ransomware mitigation.

Digital Forensics Process (Computer)

1. Securing and Documenting Evidence at the Scene

Objective: Preserve the integrity of digital evidence and maintain a clear chain of custody.

Steps:

 Secure the scene: Ensure the area containing the computer and associated devices is
sealed and protected from unauthorized access or tampering.
 Document the scene:
o Capture photographs of the computer setup and its surroundings from multiple
angles.
o Record the operational state of the computer, including whether it is powered
on, running applications, logged-in users, and connected networks.
o Note all connected peripheral devices such as USB drives, external hard disks,
memory cards, smartphones, or network cables.
 Record details in an evidence log:
o Date, time, and location of seizure.
o Names of personnel involved in handling or seizing the evidence.
o Condition and configuration of the computer and any connected peripherals.
 Assign evidence tags: Attach tamper-proof, uniquely numbered evidence tags for
accurate tracking throughout the investigation.

2. Forensic Acquisition of the Running Computer

When a computer is found in a running state, live acquisition is essential to capture volatile
data that would be lost upon shutdown.

Steps:

1. Live Response Procedures:

o Use a trusted forensic live-response toolkit (e.g., FTK Imager, Helix, Magnet
RAM Capture, or Volatility Framework).
o Avoid performing any actions that could modify or contaminate system data.
2. Capture Volatile Data:
o RAM contents (which may contain encryption keys, running processes, and
temporary activity data).
o Active processes and services with details such as process IDs and associated
executables.
o Network connections, open ports, and routing information.
o Logged-in sessions and user accounts currently active.
o Clipboard contents and temporary cache data.
o System uptime and other volatile operating system metrics.
3. Document All Actions:
o Record the exact date, time, and tools used for each acquisition activity.
o Generate and record cryptographic hash values (MD5, SHA-256) for each
captured dataset to ensure authenticity.
4. Create a Forensic Disk Image:
o Use hardware write-blockers to protect the integrity of the original storage
media.
o Create a bit-by-bit forensic image using standard tools such as EnCase, FTK
Imager, or dd (for Linux systems).
o Verify and record hash values to confirm image integrity.
5. Preserve the Original System:
o After capturing volatile data and disk images, power down the system in a
controlled and documented manner.
o Place the system and storage media in tamper-proof evidence bags and
transfer them to a secure storage location.
3. Identifying, Extracting, and Organizing Potential Digital Evidence

After acquisition, detailed forensic analysis is conducted on the forensic copy, not the
original device, to identify potential evidence of suspicious or unauthorized activity.

Potential Evidence Sources:

 Contact Lists:
o Extracted from email clients, messaging platforms, or system databases using
forensic tools such as EnCase, Autopsy, or X1 Social Discovery.
 Text Messages and Chat Logs:
o Retrieved from communication applications and email clients.
o Preserve timestamps, sender/receiver details, and associated metadata.
 Images and Videos:
o Locate visible, hidden, or deleted media files using file carving tools (e.g.,
PhotoRec, Scalpel).
o Analyze EXIF metadata for information such as timestamps, GPS coordinates,
and device details.
 Web Browsing History:
o Examine URLs, search queries, and download records using browser forensic
tools to reconstruct user activity.
 Document Files:
o Search for text documents, spreadsheets, and PDFs that may relate to the
suspected incident.
o Recover deleted files and examine file metadata for authorship and
modification times.
 Email and Cloud Storage:
o Extract and analyze emails, attachments, and synchronization logs from cloud-
based accounts.
o Identify possible unauthorized communications or file transfers.
 Deleted Files and System Artifacts:
o Use forensic recovery tools to restore deleted data.
 o Examine slack space, registry hives, and system logs for traces of deleted or
modified content.

4. Organizing Digital Evidence

Objective: Maintain proper documentation, classification, and storage of all evidence to

ensure admissibility and traceability.

Steps:

 Store recovered evidence in case-specific directories with clear, consistent labeling.

 Maintain detailed metadata logs for each piece of evidence, including hash values,
acquisition date/time, and tools used.
 Prepare a case documentation file containing:
o Summary of evidence and findings.
o Detailed acquisition and analysis logs.
o Chain of custody records.
o Supporting screenshots, log files, and forensic tool outputs.
 Secure all evidence in a controlled evidence storage facility with restricted access
and proper environmental conditions.

5. Reporting Findings

Objective: Present investigation outcomes in a format suitable for legal and investigative
review.

The final forensic report should include:

 Detailed steps of acquisition and analysis undertaken.

 Comprehensive inventory of collected evidence.
 Hash verification results confirming evidence integrity.
 Chronological reconstruction of user activity, if applicable.
 Conclusions and findings based on the evidence.
 Recommendations for further investigation, mitigation, or legal action.