Incident Response and Digital Forensics Basics
Responding under pressure
IR objective
Incident response aims to limit damage, restore operations, preserve evidence, and learn from the event. A disciplined process reduces confusion during high-stress situations.
Incident response phases
| Phase | Goal |
|---|---|
| Preparation | Build playbooks, tools, and roles |
| Detection and analysis | Confirm what happened and how severe it is |
| Containment, eradication, recovery | Stop spread, remove attacker presence, restore service |
| Post-incident activity | Improve controls and document lessons learned |
Evidence caution
Overwriting logs, rebooting too early, or failing to document actions can reduce forensic value.
Forensic priorities
First-hour response checklist
-
1
Confirm the alert and identify scope.
-
2
Isolate affected systems if appropriate.
-
3
Preserve key evidence and logs.
-
4
Reset exposed credentials and tokens.
-
5
Communicate status to stakeholders using approved channels.
Which phase focuses on learning and improvement after recovery?
Post-incident work captures lessons learned and strengthens controls.
Correct answer: Post-incident activity
What is chain of custody?
It helps preserve trust in forensic evidence.
Correct answer: A record of who collected, handled, transferred, and stored evidence
Why is volatile data valuable in forensics?
Volatile data may be lost quickly, so it must be captured early.
Correct answer: It can disappear after shutdown or reboot
Name one goal of containment.
Containment limits the blast radius while the incident is investigated.
Correct answer: To stop the attack from spreading or causing more damage