Security+
CompTIA Security+ SY0-801 / All lessons / Domain 4.0: Security Operations
4Domain 4.0: Security Operations
Security+ topic 4.8

Investigations and Digital Forensics

Investigations depend on data sources: firewall, application, endpoint, operating system and network logs, packet captures, vulnerability scans, and dashboards. Digital forensics collects evidence so it can be trusted. Collect the most volatile data first, starting with memory before the disk, because it disappears when power is lost. Make a bit-for-bit image and hash it to prove it has not changed. Keep a chain of custody that records everyone who handled the evidence. A legal hold stops data from being deleted when it may be needed for a lawsuit, and e-discovery finds relevant electronic records.

Picture itCPU cache and registersMemory (RAM)Temp files and swapDiskLogs and backupsmost volatile at the top
Order of volatility: collect what disappears fastest first.

Investigations and Digital Forensics vocabulary

  • Chain of custody: A record of everyone who handled evidence, proving it was not tampered with.
  • Order of volatility: Collecting the evidence that disappears fastest, such as memory, first.
  • Legal hold: An instruction to preserve data that may be needed for legal action.
  • Packet capture: A recording of network traffic that can be analyzed later.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A forensic investigator arrives at a running computer. Which of the following should be collected first?

  1. (A) The hard drive
  2. (B) The contents of memory
  3. (C) Backup tapes
  4. (D) Printed documents
Show answer

(B) The contents of memory Memory is the most volatile and is lost when power is removed.

2. Which of the following proves who handled a piece of evidence and when?

  1. (A) Chain of custody
  2. (B) Legal hold
  3. (C) Data masking
  4. (D) An SLA
Show answer

(A) Chain of custody Chain of custody documents every handoff.

3. A company's lawyers tell IT not to delete any email from a group of employees because of a lawsuit. Which of the following is this?

  1. (A) A legal hold
  2. (B) A retention exception
  3. (C) Data sanitization
  4. (D) Right to be forgotten
Show answer

(A) A legal hold A legal hold preserves data that may be needed in a legal case.

4. An investigator makes a bit-for-bit copy of a drive. Which of the following proves the copy matches the original?

  1. (A) Comparing hash values of the original and the copy
  2. (B) Checking the file names
  3. (C) Opening a few files
  4. (D) Comparing the drive sizes
Show answer

(A) Comparing hash values of the original and the copy Matching hashes show the image is identical.

Open 4.8 in the interactive course