The First 24 Hours of a Forensic Investigation
The first day of an investigation decides whether you'll ever know what happened. Rebooting the wrong server or 'cleaning up' a laptop can destroy the evidence you need. Here is the order I work in.
1. Don't power it off — isolate it
Memory holds running processes, network connections and injected code. Pull the network (or isolate through EDR) but keep the machine on until memory is captured.
2. Capture volatile evidence first
Work from most to least volatile.
- Memory image (FTK Imager, or EDR memory capture)
- Running processes, network connections, logged-in users
- Triage collection with KAPE: event logs, prefetch, registry hives, browser history
- Then a full disk image if the case needs it
3. Hash and document everything
Every image gets a hash, and every hand-off gets written down: who, what, when. Chain of custody is what makes findings stand up with management, insurers or legal.
4. Build the timeline
Volatility shows what was running; Autopsy and event logs show what happened on disk and who logged in. Line them up with firewall, proxy and email logs until the story makes sense: first access, persistence, movement, impact.
5. Report for two audiences
Management needs: what happened, what was affected, is it over, what to fix. Technical teams need IOCs, affected hosts and exact steps. Write both.
Tools mentioned
Isolate, don't wipe. Capture memory first, hash everything, and let the timeline — not guesses — tell you what happened.