> For the complete documentation index, see [llms.txt](https://lswsec.gitbook.io/lswsec-blueteam/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lswsec.gitbook.io/lswsec-blueteam/digital-forensics/digital-evidence-and-handling.md). # Digital Evidence and Handling * Trace evidence is often left behind. * This evidence can easily be tampered with so all evidence needs to be verified before it can be trusted. #### Types of digital evidence: * E-mails * Digital Photographs * Logs * Documents * Messages * Files * Browser History * Databases * Backups * Disk Images * Video/audio files #### Handling * Handling and securing of evidence is critical * Actions taken by digital forensic teams should not alter the original evidence * Proper documentation and justification of actions can help prevent evidence from being dismissed if evidence is altered. * Use both hardware and software write blockers to stop data being altered. * Everything should be documented #### Order of Volatility * Volatile evidence is evidence that can be lost if a system is powered down. * Registers and cache - contents of CPU is very volatile, nano seconds could be the difference between retrieving or losing data * Routing table, ARP Cache, Process Table, Kernel Statistics, Memory - highly volatile * Temporary File Systems - less volatile, but very important * Disk - less volatile but processes could overwrite data * Remote logging and monitoring data - High volatile but not as important * Physical configuration, network topology and archival media - either not vital or not volatile. #### Metadata and File carving * Metadata is data about data * File carving is a process of searching for files in a data steam and is used to retrieve deleted files from disk images **Metadata** * Look under the details tab in properties (windows) * Use either “ls -lisap \” or “stat \” * Exiftool is also an amazing tool to use **File Carving** * Tool: scalpel * First tell scalpel what to detect: /etc/scalpel/scalpel.conf * Uncomment the files you want to detect * Use scalpel by the following command: “scalpel -b -o \ \”