Digital forensics basics — memory and disk artefacts

Digital forensics is the disciplined collection and analysis of evidence from compromised systems, and it underpins both the analysis phase of incident response and the threat hunting covered later in this module. Two categories of evidence matter most: volatile memory, which disappears the moment a machine powers off, and persistent disk artefacts, which can survive for months. Understanding both, and the order in which to collect them, is foundational forensic knowledge.

Analogy🏏Cricket

🎬 Think of it like movies: a detective film gathers two very different kinds of clue. Volatile memory is the fleeting confession overheard in a crowded room — gone the instant the crowd disperses, so it must be caught right now or not at all. Persistent disk artefacts are the paper trail in the filing cabinet: durable, still readable months later, but only recording certain facts. The plot only makes sense once the detective weighs both together, and crucially collects the vanishing evidence before turning to the durable kind. This reveals why forensics values both categories and the strict order in which they must be gathered.

Memory forensics captures a live snapshot of a running system: active processes, open network connections, loaded drivers, and code injected directly into memory that may never touch the disk at all. This makes memory the only place to find certain sophisticated attacker techniques, but it is also the most fragile evidence, overwritten continuously as the system keeps running, which is why the order of volatility principle places memory capture ahead of almost every other evidence source.

Analogy🏏Cricket

💪 Think of it like fitness: capturing live memory is like reading your heart-rate the instant you finish a hard sprint. In those first seconds it reveals exactly how your body responded — a peak that never gets written into any logbook and vanishes as your pulse settles back to normal within a minute. Wait too long and that fragile peak is simply overwritten by your resting state, unrecoverable ever after. That is why a serious athlete checks the monitor immediately, before anything else, just as the order of volatility demands memory be captured ahead of every more durable source. This reveals why the most fleeting evidence is always taken first.

Under the hood, disk forensics recovers a different, more durable class of evidence: file system timestamps showing when files were created or modified, deleted files that often remain partially recoverable until overwritten, browser history, and system logs that were never sent to the centralised logging pipeline from Module 4. Correlating disk artefacts against memory findings and centralised logs together builds a far more complete picture than any single evidence source could provide alone.

Analogy🏏Cricket

♟️ Think of it like chess: disk forensics is replaying the recorded scoresheet of a finished game. The notation durably preserves every move made — the timestamps of when pieces shifted, captures that were later reversed, the openings tried — long after the board itself was cleared away. But the scoresheet alone never shows what the player was actually thinking in the moment. Only by laying the durable notation alongside the live commentary and the arbiter's central record do you reconstruct the whole game accurately. This reveals why disk artefacts must be correlated with memory and centralised logs rather than read in isolation.

bash

# Order of volatility: capture the most fragile evidence first
1. RAM / memory contents         (most volatile, capture first)
2. Network connections / ARP cache
3. Running processes
4. Disk contents
5. Remote logging / centralised log data (least volatile, capture last)

# Example memory capture command (Linux, using LiME)
insmod lime.ko "path=/mnt/evidence/mem.lime format=lime"

Best practice always follows the order of volatility, capturing memory before powering a system off, since a well-meaning responder who shuts a machine down first destroys the most valuable evidence permanently. Use a write blocker when imaging disks so the investigation process itself cannot alter the evidence, maintain a documented chain of custody for every artefact collected, and work from copies rather than the original evidence whenever possible, preserving the source for any later legal or deeper technical review.

Analogy🏏Cricket

🍳 Think of it like cooking: following the order of volatility is like handling a delicate soufflé the instant it leaves the oven — photograph it before it inevitably collapses, because powering the system off is exactly that collapse and it is irreversible. A write blocker is using a separate tasting spoon so you never contaminate the pot you are judging. Chain of custody is labelling every sample with who handled it and when, and working from copies is plating a duplicate portion for inspection while the original dish stays untouched for the head chef. This reveals why disciplined handling preserves the evidence for any later review.

In the real world, an analyst investigating a suspected fileless malware infection that leaves almost nothing on disk might find the attacker's entire toolkit only by capturing memory before the affected server was rebooted. Had the team's first instinct been to power off the machine to stop the attack, as containment intuition might suggest, that critical memory evidence would have vanished, leaving investigators with disk artefacts alone and a far weaker understanding of what actually happened.

Analogy🏏Cricket

💰 Think of it like finance: investigating fileless malware is like tracing a fraud that leaves nothing in the printed statements, existing only as a live session still open on the trading terminal. Capture that session's screen before anyone logs out and you see the attacker's entire scheme; the moment the terminal is closed, that view is gone for good. A responder whose first instinct is to power the server off to stop the attack is effectively logging out that terminal, destroying the only record of a scheme that never once touched the ledger. This reveals why volatile memory must be preserved before shutting anything down.

Digital forensics collects evidence from both volatile memory and persistent disk.
Memory captures a live snapshot, including fileless techniques invisible on disk.
The order of volatility means memory must be captured before more durable evidence.
Disk forensics recovers timestamps, deleted files, and logs never sent to centralised logging.
Use write blockers, work from copies, and maintain documented chain of custody.