forensics-checklist

Digital forensic evidence collection requires a disciplined workflow following NIST SP 800-86 and RFC 3227 volatility order to preserve chain of custody. You must capture volatile artifacts first, generate SHA-256 integrity hashes, and maintain documentation proving evidentiary provenance.

The correct volatility order prioritizes memory acquisition and runtime state capture before disk imaging to prevent data destruction. Following RFC 3227 guidelines, you capture volatile artifacts first, then proceed to bitstream imaging and time-bounded log export for investigation continuity.

Cloud forensics collection adapts evidence gathering for AWS, Azure, and GCP environments. It handles cloud-specific constraints by guiding snapshot capture, audit log preservation, and retention limit management to maintain evidence integrity across different cloud platforms.

Evidence integrity verification uses SHA-256 hash workflows to prove digital artifacts remain unaltered during acquisition. You compute cryptographic hashes immediately after capture and document them in chain-of-custody records to establish evidentiary provenance for admissible proof.

Chain of custody documentation requires tracking evidence handling from SOC triage through full acquisition using an evidence report output schema. You record every transfer, generate integrity hashes, and maintain auditable provenance records following NIST SP 800-86 standards.

NIST SP 800-86 and RFC 3227 standards apply whenever incident response escalates to digital forensics requiring admissible proof of compromise. You need these guidelines for SOC triage, volatile-data capture, disk imaging, and cloud evidence collection to prevent evidence loss or contamination.