Lessons · Cybersecurity · preserving evidence

Preserving evidence

Evidence is anything that shows what happened, and it has to be copied, timed and signed for, because evidence nobody can vouch for proves nothing later.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

Six months on, in a meeting with lawyers and an insurer, the question is not what you believe happened. It is what you can show, and who can say it has not been altered since. That is decided on the night, by whoever takes the copy.

How to think about it

Work on copies, never on the original. Record the hash of each copy so it can be shown unchanged. Write down who took it, when, and who has held it since. Keep the logs before they roll over, because retention deletes evidence on a schedule that does not care about your incident.

Worked example

Copy the disk and the logs; leave the originals alone

Investigation happens on the copy.

Hash each copy and write the value down

The fingerprint that shows the copy has not changed since.

Record who took it, when, and who holds it now

Each handover is a line in the record.

Export the logs before the retention period deletes them

Evidence has a timer on it that nobody set for this incident.

Your turn

Write the three-word name for the record of who has handled the evidence and when.

the record is called the

The trap

Investigating on the original machine. Every command you type changes it, and by morning nobody can tell your fingerprints from the attacker's.

Practise preserving evidence on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.