Incident Response Evidence Handling
Security
Overview
Document collection time, collector, source and transformations. Hashes detect later changes, while chain of custody documents handling. Work on copies and protect original evidence. Isolation and collection order depend on risk and volatility; never claim a hash proves who created a file.
Protocol stages
- 1Acquire
- 2Hash
- 3Record custody
- 4Analyze copy
- 5Re-verify
Interactive exercise
Knowledge check
You receive a packet capture. Before editing or converting it for analysis, what should you do?
Educational model — not real hardware, traffic or official certification.