Security Operations

Collect the most volatile evidence first: CPU registers/cache, then RAM and running state, then disk, then logs/archives. Volatile data disappears on power loss, so it must be captured before less-volatile sources.

Chain of custody is the documented, unbroken record of who collected, handled, controlled, transferred, and stored each piece of evidence, including when and why. It establishes integrity for court admissibility.

To create an accurate, defensible record of findings, methods, and timelines that supports decisions, legal proceedings, and lessons learned. Documentation must be objective, complete, and contemporaneous.

Interviews (gathering statements from people), root-cause analysis (identifying the underlying cause), and timeline reconstruction (ordering events to understand what happened).

An interview gathers information from cooperative or neutral parties to establish facts; an interrogation is a more formal, accusatory questioning of a suspect, typically conducted by law enforcement.

Forensic imaging creates an exact bit-for-bit copy of storage media so analysis is performed on the copy, not the original. This preserves the original evidence and lets the image be verified against it.