Digital Forensics Basics: How to Investigate a Breach Without Compromising Evidence

The alert is confirmed. It’s a real breach.

Now, the pressure is on. Everyone is asking questions you can’t yet answer:

• “How did they get in?”
• “What did they take?”
• “Are they still inside?”
• “How do we make sure this never happens again?”

In the critical moments after an incident, guesswork is a liability. You need facts. You need evidence.

This is where digital forensics separates a professional Incident Response (IR) team from an amateur one. It’s the methodical process of collecting, preserving, and analyzing digital evidence to reconstruct events and understand the full scope of a security incident.

Think of it as being a digital crime scene investigator. Your goal isn’t just to kick the attacker out; it’s to understand the entire story of the attack—the who, what, when, where, how, and why—so you can effectively eradicate the threat and prevent recurrence.

The Golden Rule: Preserve the Scene First

Your first instinct might be to start poking around on the compromised system. Fight that instinct.

The single most important principle in digital forensics is to preserve the evidence in its most pristine state. Once you start clicking around, opening files, or running untrusted tools, you alter the crime scene. You change timestamps, overwrite volatile data, and potentially tip off the attacker.

Your mantra: First, do no harm.

The Four Pillars of a Forensic Investigation

Every effective forensic process follows these core phases:

1. Acquisition: Creating a Forensic Image

This is step one. You do not analyze the original production system.

• What it is: Creating a bit-for-bit, sector-by-sector copy of the storage media (hard drive, SSD). This is called a forensic image (often in a .E01 or .dd format).
• Why it matters: It preserves every byte of data, including deleted files, slack space, and unallocated clusters, without altering the original evidence. This image becomes your “working copy.”
• Key Tool: FTK Imager, dd, or Guymager. Always hash the image (with MD5/SHA-1) to prove its integrity hasn’t changed since acquisition.

2. volatile Data: Capturing What’s in Memory

The most crucial evidence often lives in RAM—and it disappears the moment the machine powers off.

• What it is: Data that exists only while a system is running. This includes running processes, open network connections, logged-in users, clipboard contents, and decryption keys.
• Why it matters: Modern attackers (and malware) live off the land in memory to avoid writing files to disk. Missing this means missing the attacker entirely.
• How to capture it: Use a trusted, pre-compiled tool dumped from a USB drive. Never run tools from the compromised machine’s disk.
• Key Tools: Magnet RAM Capture, Belkasoft Live RAM Capturer, or Volatility (for analysis).

3. Analysis: Hunting for Evidence

This is the investigation phase, performed on your forensic image and memory dump, not the live system.

• Timeline Analysis: Building a super-timeline of system activity (file creation, execution, deletion) to find anomalous events around the time of the breach.
• File System Forensics: Examining file system artifacts: browser history, prefetch files (Windows), bash history (Linux), registry hives, and LNK files.
• Memory Analysis: Using a tool like Volatility to analyze your RAM dump for rogue processes, injected code, network sockets, and hidden API hooks.
• Log Analysis: Correlating findings with centralized logs (SIEM) for a complete picture. The disk and memory tell you what happened; logs often tell you how it was initiated.

4. Reporting: Telling the Story

Your investigation is useless if you can’t communicate it clearly to management, legal, and other stakeholders.

• What to include: Executive summary, detailed methodology, timeline of events, indicators of compromise (IOCs), and actionable recommendations for improving security controls.
• Why it matters: This document is often used for legal proceedings, insurance claims, and audit compliance. It must be clear, factual, and objective.

Your Starter Kit: Essential Forensic Tools

You don’t need a six-figure lab to start. This open-source and freemium toolkit is where every IR pro begins.

Tool	Category	Use Case
FTK Imager	Acquisition	Creating and verifying forensic images. The industry standard free tool.
Autopsy	Analysis	A user-friendly GUI for analyzing disk images, timeline creation, and keyword searching.
Volatility	Memory Analysis	The powerful, open-source framework for analyzing RAM dumps. (Steep learning curve)
Wireshark	Network Analysis	Capturing and analyzing network traffic (pcaps) to see command-and-control communication.
Eric Zimmerman’s Tools	Artifact Analysis	A suite of CLI tools for deep analysis of Windows artifacts (Prefetch, Jumplists, Registry).

The Unbreakable Chain of Custody

If there’s any chance of legal action, you must maintain a chain of custody. This is a legal document that tracks:

• Who collected the evidence
• When and where it was collected
• Who has handled or stored it since collection
• How it has been secured (e.g., in a locked safe)

A broken chain of custody renders evidence inadmissible in court.

The Bottom Line: Forensics is a Force Multiplier

Digital forensics isn’t about being a detective after the fact. It’s a core IR skill that enables you to:

• Respond with precision, rather than blindly shutting down systems.
• Understand the root cause to implement effective mitigations.
• Provide definitive answers to leadership, reducing uncertainty and panic.
• Build a stronger defense by learning from every attack.

Start by mastering evidence acquisition. Practice creating a forensic image of a virtual machine. Then, explore the artifacts within it. This foundational skill will forever change how you respond to incidents.

Ready to dive deeper into IR? Explore our full incident response lifecycle guide.
Back to Incident Response