forensic workflow

Overview

The individual skills — recognizing artifacts, preserving evidence, reading timestamps, analyzing files — only produce trustworthy results when they are applied in the right order, following a disciplined process. This lesson ties the module together into a sound forensic workflow: acquire → preserve → analyze → report. Following a consistent workflow keeps your findings reproducible, defensible, and free of accidental contamination, whether you are solving a CTF or responding to a real incident under authorization.

Learning objectives

• Describe the four phases of a forensic workflow and their order.
• Explain what each phase protects and why the order matters.
• Understand documentation as a continuous activity, not a final step.
• Apply the workflow to a practice scenario.

Core concept

A forensic workflow is a repeatable process that takes you from an unexamined source to a defensible conclusion without compromising the evidence along the way. The classic phases are:

1. Acquire — obtain the data safely, capturing a faithful copy of the source.
2. Preserve — protect the integrity of that copy so it can be trusted throughout and afterward.
3. Analyze — examine the preserved copy to answer the investigative questions.
4. Report — communicate what you found, how you found it, and what it means.

The order is not arbitrary. Each phase depends on the one before it: you cannot preserve what you have not acquired, you must not analyze before preserving (or you may alter the evidence), and you cannot report credibly unless the earlier phases were sound. Running throughout all four is documentation — you record what you do as you do it, not from memory afterward.

How it works

Acquire. Capture the source data with minimal disturbance. This means imaging storage through a write blocker, and — when relevant — collecting volatile data (such as memory and active network connections) before shutting a system down, because that data disappears when power is lost. This introduces the idea of order of volatility: collect the most fleeting evidence first. You always work toward a copy so the original stays pristine.

Preserve. Immediately establish integrity: compute cryptographic hashes of the acquired image, store the original securely, and begin (or continue) the chain of custody record. From here on, all analysis happens on verified copies, and the recorded hash lets anyone confirm the data never changed.

Analyze. Now, and only now, examine the copy. Apply the earlier skills: recover and correlate artifacts, build a timeline from MAC timestamps normalized to UTC, and perform file analysis (signatures, metadata, strings, hidden data). Form hypotheses and test them against multiple sources rather than over-reading a single artifact. Because you are working on a copy, you can safely experiment and, if needed, start over from the pristine image.

Report. Communicate findings clearly and honestly: what you examined, the methods and tools you used, what you found, and — importantly — the limits of your conclusions. A good report is reproducible: another examiner following your documented steps on the same evidence should reach the same result. State facts and distinguish them from interpretation.

Documentation binds the phases: note times, actions, hashes, tool versions, and decisions as you go. Contemporaneous notes are far more trustworthy than reconstructed ones and are what make the whole process defensible.

Practical example

In an authorized lab you are given a practice scenario: a virtual machine is suspected of having run an unauthorized program, and you must determine what happened.

1. Acquire. The VM is running, so you first capture volatile data (memory and active connections) because it will vanish on shutdown, then image the disk. You note that you acquired memory at, say, 10:02 UTC and the disk image at 10:20 UTC.
2. Preserve. You compute a SHA-256 hash of the disk image and record it. You store the original image read-only and log the acquisition in your chain-of-custody notes. All further work uses a working copy.
3. Analyze. On the copy, you extract artifacts: an execution record shows a program ran at 09:47 UTC; file analysis of that program reveals embedded strings pointing to a hostname; and MAC timestamps place a new file's creation right after the program ran. Normalizing everything to UTC, you assemble a coherent timeline.
4. Report. You write up the sequence — program executed at 09:47, file created at 09:48, connection attempt to the observed host — noting your methods, the image hash, and that the hostname is an indicator to corroborate, not a proven destination. Another analyst could re-run your steps on the same image and confirm the timeline.

Every conclusion rests on a preserved, hash-verified copy, and every step is documented — which is exactly what makes the result trustworthy.

[!WARNING] Apply this workflow only to systems and data you are authorized to investigate — CTF challenges, lab environments, or systems you have explicit written permission to examine.

Cybersecurity relevance

A disciplined workflow is the difference between an investigation whose findings hold up and one that collapses under scrutiny. In professional incident response and digital forensics, the acquire → preserve → analyze → report process (with order of volatility and continuous documentation) is standard practice precisely because it produces reproducible, defensible results. Skipping preservation or documenting from memory can invalidate otherwise correct findings.

The same discipline improves your CTF performance: acquiring a working copy of the challenge file, keeping the original to restart from, analyzing methodically, and noting what you tried all make you faster and less error-prone. The habits you build in labs — order, integrity, documentation — are exactly the habits that make a real-world investigator credible.

Common mistakes

• Analyzing before preserving, altering the evidence and losing integrity.
• Shutting down a live system before capturing volatile data, destroying memory and connection evidence (ignoring order of volatility).
• Documenting from memory afterward instead of taking contemporaneous notes.
• Overstating conclusions in the report rather than distinguishing fact from interpretation.
• Skipping the hash, so the analyzed data cannot be proven unchanged.

Key takeaways

• The forensic workflow is acquire → preserve → analyze → report; the order matters because each phase depends on the soundness of the previous one.
• Acquire faithful copies (through write-blocking) and capture volatile data first, following order of volatility; preserve integrity with hashes and chain of custody before any analysis.
• Analyze only the preserved copy, correlating artifacts and timelines; report reproducibly, separating facts from interpretation.
• Documentation is continuous, not a final step, and is what makes the entire process defensible.

Check your understanding

• Why must the preserve phase come before the analyze phase, and what could go wrong if they are reversed?
• What is "order of volatility," and how does it influence what you collect first when acquiring data from a running system?