Digital Forensics Basics: Evidence & Chain of Custody
Digital forensics is the disciplined collection and analysis of digital evidence — done in a way that keeps it accurate and legally admissible. In a SOC, forensics answers "what exactly happened, and can we prove it?"
Order of volatility
Evidence disappears at different rates, so you collect the most fragile first: RAM (memory) before disk before backups. Memory holds running processes, live network connections and encryption keys that vanish on power-off — which is why "pull the plug" is often the wrong first move.
Chain of custody and integrity
Every piece of evidence needs a documented chain of custody — who handled it, when, and how it was stored — or it's worthless in court. Integrity is proven with hashing: hash the evidence at collection, and a matching hash later proves it wasn't altered. These are testable CyberOps concepts.
Frequently asked questions
What is the order of volatility?
The sequence for collecting evidence from most to least fragile — RAM/memory first, then disk, then archival backups — so nothing perishable is lost.
What is chain of custody?
Documentation of everyone who handled a piece of evidence, when, and how it was stored — essential for the evidence to be trusted and admissible.
How is evidence integrity proven?
By hashing the evidence at collection and comparing hashes later — identical hashes prove it was never altered.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.