Digital Forensics & Incident Response

A SOC monitors systems in real time and decides whether alerts are real. DFIR usually starts once an incident is confirmed or likely, and reconstructs what happened, how, how far it spread and what was taken, using disk, memory, network and file evidence.

NIST SP 800-61 Rev. 2 describes four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2024 revision maps these activities onto the functions of the NIST Cybersecurity Framework 2.0.

A SHA-256 hash is a fingerprint of a file's exact contents. Recording it on receipt and checking it again later proves the evidence was not altered. Investigators also work only on copies and keep the originals read-only.

It is the principle of collecting the most short-lived evidence first. RFC 3227 lists registers and cache, then memory and processes, network state, temporary files, disk, remote logs and finally archives and backups.

Usually not as a first step. Powering off destroys memory, running processes and live connections. A common approach is to isolate the machine from the network, collect volatile data and then decide according to the organisation's playbook.

Tools like touch can backdate a file's modification and access times, but the kernel then sets the inode change time (ctime) to the real current time, and the birth time cannot be set normally. An mtime older than the birth time is therefore suspicious – though archive extraction and cp -a cause the same pattern, so look for corroboration.