Forensic work is governed by purpose, authority, scope, repeatability, and evidence integrity. Collect volatile evidence when justified, hash acquired artifacts, record tools and operators, and maintain chain of custody. A timestamp is meaningful only when clock sources and timezone are understood.
observation: token used from two distant networks in 4 minutes
inference: credential may be compromised
next test: inspect device, MFA, session, and access logs
Build timelines from endpoint, identity, DNS, firewall, application, and cloud records. Avoid overclaiming: correlated events suggest a hypothesis; they do not prove intent. Protect forensic data because it may contain credentials, personal data, or sensitive business information.
Exercises
Construct a timeline from five event records.
Write a chain-of-custody entry.
Separate facts, hypotheses, and unanswered questions.
Self-check
Why hash evidence?
What is chain of custody?
Why normalize time?
Self-Check Quiz
1. What does a hash help demonstrate?
AnswerThat an artifact remained unchanged relative to the recorded digest, assuming the process is trustworthy.
2. Is an inference the same as an observation?
AnswerNo. An observation is recorded evidence; an inference is a reasoned hypothesis based on evidence.
Homework
Investigate a fictional account-compromise timeline.
Specify evidence, collection authority, and integrity controls.
Write findings with confidence and gaps.
Sample answerRecord source, timestamp, timezone, actor, collector, tool, hash, storage, and access history. State that unusual geographic use is evidence consistent with compromise, then test MFA, device, session, and application records before concluding.