When I first started out, as a junior with a real intern vibe, I was called into an incident response case. My excitement was through the roof—I felt like that guy with the sunglasses from CSI: Miami. There was some suspicious activity on a client's server. And what did I do? I dove in as 'root', browsed every file with 'ls -la', jumped in and out of directories. I didn't realize it then, but I was basically murdering the evidence. By updating the 'access time' (atime) of every folder I entered and every file I touched, I contaminated all the proof of when the attacker actually accessed those files. That day, I learned that forensics isn't an art; it's a discipline. And the golden rule: Don't touch, observe first.
The Concept of 'Evidence' in the Digital World
Listen, folks, forensics isn't just about recovering deleted files. That’s the 'underground' or data recovery side of things. Our job is to lay out what happened in a system, in chronological order, in a way that’s provable in court (or in front of the board).
When a system is breached, no matter how professional the attacker is, they always 'whisper' somewhere. A flicker in the Windows Registry, a string in a dusty corner of the RAM, or a tiny entry inside the MFT (Master File Table)... To hear those whispers, we need the right tools and, most importantly, the right mindset.
Order of Volatility
What’s the first thing you take when you walk into a crime scene? The hard disk? Nope. If you pull the disk, you lose all that precious 'live' data in the RAM forever. There’s a hierarchy in forensics:
- RAM (Memory): This is the most volatile. The moment you pull the plug, it’s gone. Malicious code running, encrypted connections, open ports—it’s all here.
- Swap/Page Files: Data written to the disk when RAM is full.
- Network State: Active connections.
- Disk Data: Files, logs, registry.
- Archives/Backups: The least volatile stuff.
The Mysterious World of Memory: Volatility
Taking a 'memdump' used to be a pain, but now we have Volatility to back us up. Let’s say we caught a suspicious workstation on the testCompany network. First step: grab the memory image. Once we have it, we take a look at what’s going on with this command (defanged, obviously):
# Listing active processes in the memory image
volatility -f memory_dump.sample --profile=Win10x64_19041 pslist
# To catch hidden or terminated processes
volatility -f memory_dump.sample --profile=Win10x64_19041 psscan
While pslist gives us a standard list, psscan shows us those sneaky 'unlinked' processes the attacker tried to hide. For example, if you see something named svchost.exe but its parent process isn't services.exe, take a deep breath. You’re likely looking at a 'process hollowing' case.
Artifact Hunting: On the Trail
Windows systems are essentially their own informants. Everything is logged.