Day 1: Preparing for Evidence Before Incidents

Defining Legal Authority

• Legal authority for investigation
• Clarify evidence collection boundaries
• Consider applicable privacy requirements
• Record of approvals before examination

Building Forensic Readiness

• Verify digital evidence integrity
• Configure required log retention
• Collection procedures in advance
• Train teams on preservation

Preserving Digital Evidence

• Isolate media without alteration
• Record collection time and location
• Use of suitable preservation methods
• Record of full custody chain

Day 2: Reading the Digital Crime Scene

Acquiring Forensic Images

• Create exact forensic media copies
• Use trusted forensic acquisition tools
• Compare pre-acquisition and post-acquisition hashes
• Protect originals against modification

Validating Evidence Hashes

• Criteria for approved hashing algorithms
• Hash the original source
• Hashes of forensic copies
• Record of final verification results

Analyzing System Artifacts

• Inspect important operating system logs
• Analyze temporary files and artifacts
• Link user activity with events
• Suspicious environment changes and artifacts

Day 3: Following Evidence Across Systems and Clouds

Analyzing Network Artifacts

• Inspection of available network logs
• Analyze addresses ports and sessions
• Connect sessions to event timelines
• Suspicious external connection patterns

Examining Cloud Artifacts

• Collect cloud control plane logs
• Inspect account and resource changes
• Analysis of source addresses used
• Link events with actor identity

Analyzing Malicious Samples

• Isolate samples inside a laboratory
• Identify file type and properties
• Inspection of likely malicious behavior
• Extract useful investigation indicators

Day 4: Turning Artifacts into a Defensible Narrative

Building Event Timelines

• Normalize timestamps across sources
• Order events by occurrence time
• Important event timeline gaps
• Link events with incident stages

Assessing Attribution Limits

• Distinguish evidence from inference
• Assess reliability of identity indicators
• Prevention of unsupported attribution claims
• Document alternative explanations clearly

Preparing Forensic Reports

• Define investigation scope clearly
• Describe methods and tools used
• Link findings with supporting evidence
• Documented limits and final conclusions

Day 5: Closing the Case with Investigative Readiness

Delivering Expert Testimony

• Explain findings in plain language
• Distinguish facts from opinions
• Answer questions within expertise
• Maintain neutrality during testimony

Reviewing Case Files

• Completeness of required documents
• Review coherence between evidence findings
• Verify chain of custody records
• Missing items before closure

Strengthening Investigation Readiness

• Identify required forensic tools
• Prepare standardized documentation templates
• Access to important logs
• Train teams on procedures

• Review a realistic example to evaluate Defining Legal Authority
• Hands-on lab examining practices in Analyzing System Artifacts
• Hold a guided discussion comparing alternatives for Assessing Attribution Limits
• Complete an individual task documenting steps in Strengthening Investigation Readiness