Acquire in order, hash it, and prove nothing changed

short · 60 min · Objective 3.3

Task

Perform a full acquisition from a lab host in order of volatility, hash everything, work only from copies, and then demonstrate why the rule exists by showing your own analysis modifying a working copy.

Steps

  1. Decide the order before you touch anything, and write it down: memory, network state, running system state, disk, then collected logs.
  2. Volatile first. Capture memory to external storage. Then capture network connections, the process list, logged-on users and the routing table, each to its own file with a timestamp.
  3. Then disk. Take a targeted collection -- authentication logs, shell history, cron and systemd units, the web root -- rather than a full image, and write down why that was the right choice here.
  4. Hash everything with SHA-256 as you acquire, into a manifest file.
  5. Record your own footprint. Every command you ran, when, and as whom. Your traces are in this evidence and must be distinguishable from anyone else's.
  6. Make a working copy. Analyse the copy -- mount it, open files, run tools.
  7. Re-hash the original and the working copy. Compare both against the manifest, and explain the difference.

Verify

sha256sum -c /tmp/evidence/manifest.sha256 2>&1 | grep -c ": OK$"
sha256sum -c /tmp/evidence/manifest.sha256 2>&1 | grep -c "FAILED"
sha256sum /tmp/evidence/auth.log /tmp/working/auth.log | awk '{print $1}' | uniq | wc -l
ls -la /tmp/evidence/ | grep -c "^-r--"

Every original must verify OK and none may fail. The third command is the point of the lab: if it prints 2, the working copy has diverged from the original, which is exactly what analysis does and exactly why you never do it to the original. The last confirms the originals are read-only, which is the cheap mechanical protection behind the whole practice.

Notes

If your working copy did not diverge, you did not analyse it hard enough -- mount it, grep it, open something with a tool that writes. The divergence is the demonstration.

The footprint record from step 5 is the one that is always regretted when missing. An investigation that cannot distinguish its own traces from the intruder's has created a problem it cannot solve afterwards.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.