Forensic Acquisition and Tool Validation

Introduction and Context

Forensic acquisition is the controlled process of identifying, collecting, preserving, copying and documenting digital information so that it can later be examined and presented as evidence. It is not simply the act of making a copy of a hard disk. A defensible acquisition must preserve evidential integrity, minimise alteration, record the actions taken and demonstrate that the resulting copy is complete and suitable for examination.

Digital evidence may exist in volatile locations such as processor registers, memory, running processes and network connections, or in non-volatile media such as solid-state drives, hard disks, removable media, mobile devices and cloud repositories. The acquisition method must therefore be selected according to the evidence source, the investigative question, the operating condition of the device and the applicable law or organisational policy.

The central principle is reproducibility. Another competent examiner should be able to understand what was collected, how it was collected, which tools and settings were used, what hashes were calculated, what limitations existed and how the evidence was protected after acquisition.

Learning Objectives

By the end of this chapter, a learner should be able to:

• distinguish volatile from non-volatile evidence;
• select live, dead-box, logical or physical acquisition methods;
• explain the purpose and limitations of write blockers;
• acquire and verify forensic images using cryptographic hashes;
• maintain a complete acquisition record and chain of custody;
• validate forensic tools through structured testing;
• evaluate tool limitations, error conditions and version changes; and
• make professionally defensible acquisition decisions within legal and ethical constraints.

1. Evidence Sources and Acquisition Decisions

1.1 Volatile and non-volatile evidence

Volatile evidence is information that can disappear or change when power is removed or when a system continues operating. Examples include:

• RAM contents, including encryption keys, injected code and recently used data;
• running processes and loaded modules;
• active network connections and routing information;
• logged-on users and session tokens;
• command history held only in memory;
• system time, uptime and current configuration; and
• temporary files and clipboard contents.

Non-volatile evidence remains available after shutdown, although it may still be altered by normal device operation. Examples include files, directory structures, file-system metadata, browser databases, event logs, unallocated space and application data stored on persistent media.

Volatile evidence is not automatically more important than non-volatile evidence. Its priority depends on the investigation. For example, RAM may be essential in a suspected ransomware case because it may contain encryption keys, whereas a powered-off computer may provide the safest opportunity for a controlled disk acquisition.

1.2 Acquisition choices

An examiner normally chooses among four broad approaches:

The decision should be based on the investigative question, not convenience. A documented decision may consider whether the system is powered on, whether full-disk encryption is active, whether remote destruction is possible, whether malware may be running, whether the device is legally within scope and whether the examiner has an approved tool for the task.

1.3 Order of volatility

A commonly used principle is to collect the most volatile information first, subject to safety and investigative priorities. A general sequence may be:

1. note the screen, visible applications and physical state;
2. record time, connected devices and network status;
3. collect RAM and relevant live-system information;
4. record active connections, processes and logged-on users;
5. isolate the device from networks when authorised and safe;
6. acquire persistent storage; and
7. collect external, cloud or provider-held records through lawful procedures.

This is a guide rather than an inflexible rule. Running a live-response tool can modify memory and disk, and collecting RAM from a hostile system may expose the examiner to malware or remote interference. The examiner must document why the chosen order was appropriate.

2. Legal, Ethical and Governance Requirements

Acquisition must be authorised. Depending on the jurisdiction and context, authority may come from a warrant, court order, consent, employment policy, incident-response mandate or contractual agreement. The authority should define the devices, accounts, time period and categories of information within scope.

Important governance principles include:

• Necessity and proportionality: collect only what is reasonably required.
• Integrity: preserve the original and work from verified copies.
• Accountability: record who performed each action and when.
• Confidentiality: protect personal, privileged and commercially sensitive information.
• Minimal alteration: use controls that reduce changes to source media.
• Disclosure and repeatability: retain sufficient documentation for independent review.

Cloud, mobile and cross-border acquisition may involve different jurisdictions and provider policies. An examiner should not bypass authentication, defeat security controls or access an account merely because a technical method exists. Legal review may be necessary when evidence includes privileged communications, employee personal data, health information or data stored in another country.

Ethically, an examiner must not overstate what a tool or image proves. A forensic image is a representation of a source at a particular time; it does not establish who created a file, why an action occurred or whether a user intended a result without supporting evidence.

3. Preparing for Acquisition

Preparation prevents avoidable evidential and operational failures. A case plan should identify:

• case identifier and investigative objectives;
• source devices and their current condition;
• authority and scope;
• personnel, roles and approvals;
• acquisition method and tools;
• storage destination and capacity;
• time source and time-zone convention;
• hashing algorithm and verification procedure;
• safety requirements, including malware and electrical risks; and
• contingency procedures for damaged, encrypted or unsupported media.

Before use, the examiner should verify that the destination has sufficient capacity and that the acquisition workstation is clean, access-controlled and time-synchronised. Evidence storage should use appropriate permissions, encryption where required and reliable backup. Working copies must be distinguishable from master evidence.

The examiner should photograph or otherwise record the device, labels, ports, cable connections, screen state, visible damage and attached media. Unique identifiers such as serial numbers, asset tags and network addresses should be recorded without relying solely on a manufacturer label, since labels can be inaccurate or duplicated.

4. Write Blockers and Source Protection

A write blocker is a hardware or software control intended to prevent a forensic workstation from writing to the source medium. Hardware write blockers are generally preferred for conventional storage because they create a clearer separation between the examiner's system and the evidence. Software controls may be useful but require careful configuration and validation.

A write blocker does not make every acquisition safe. It may not support a particular interface, command or storage technology. Some devices, especially modern solid-state drives, may perform internal housekeeping independently of the examiner. A write blocker also does not prevent an examiner from accidentally selecting the wrong disk or altering a mounted destination.

Before case use, the blocker should be tested with representative media. Testing should examine whether:

• the source can be read;
• attempted writes are rejected or blocked;
• normal acquisition commands succeed;
• device identification is reported correctly; and
• the blocker behaves consistently across interfaces and operating systems.

The model, serial number, firmware version, test date and test result should be recorded. A failed or untested blocker should not be treated as reliable merely because it is labelled “forensic.”

5. Live Acquisition

Live acquisition is performed while a system is powered and operating. It is appropriate when volatile evidence is important, when encryption keys may be present only in memory or when shutdown would trigger data destruction or loss of access.

A live procedure should be deliberate and minimal. The examiner should first observe and document the system without unnecessary interaction. Approved tools should be carried on trusted media and executed with commands that are known to produce minimal changes. Results should be redirected to a controlled destination rather than saved to the source where possible.

Typical live-collection categories include RAM, process lists, network connections, open files, logged-on users, system time, mounted volumes and relevant configuration. RAM acquisition should be performed before actions likely to change memory substantially. A memory image should be hashed and preserved like any other evidence.

Live acquisition has significant limitations. Starting a tool creates processes, allocates memory and may update logs. Malware may detect collection activity, alter results or communicate with an external party. A live image is also a snapshot of a changing system rather than a perfectly simultaneous representation of all state. These limitations must be stated in the report.

If full-disk encryption is active, live acquisition may be the only practical way to obtain decrypted content or keys. Conversely, if a system is unstable or suspected of destructive malware, continued operation may cause greater loss. The decision to continue, isolate or power down should be authorised and documented.

6. Dead-Box and Physical Acquisition

In dead-box acquisition, the device is powered off or otherwise prevented from running before persistent storage is copied. The source is connected to a validated write blocker, and a forensic imaging tool creates a bit-stream image or another approved forensic representation.

A typical procedure is:

1. identify and photograph the source;
2. record the power state and remove power according to procedure;
3. label the source and assign an evidence identifier;
4. connect the source through a tested write blocker;
5. confirm the source and destination identities;
6. select the approved image format and settings;
7. calculate a source or acquisition hash as supported;
8. create the image while recording errors and bad sectors;
9. calculate verification hashes for the image;
10. compare results and document any discrepancy; and
11. seal and return the source to secure storage.

A physical image attempts to represent addressable storage, including active files, deleted material and unallocated areas. It may contain file-system slack, partition structures and remnants that logical collection would omit. However, a physical image may not include data held in inaccessible firmware areas, encrypted content without keys or cloud-only records.

Modern solid-state storage introduces complications. Wear levelling, garbage collection and the TRIM command can make deleted-data recovery unreliable. These behaviours may occur independently of examiner intent. Consequently, an examiner must avoid promising recovery of deleted files from an SSD and should record the device technology and relevant acquisition conditions.

7. Imaging Formats and Hash Verification

A forensic image may be raw, proprietary or an evidence-container format. Raw images are simple and broadly supported but may lack embedded metadata and may require separate documentation. Evidence-container formats can store metadata, segmentation, compression and error information, but they depend on tool support and correct implementation.

Cryptographic hashes provide integrity checks. For a byte sequence M, a cryptographic hash function produces a digest:

Here, M is the acquired byte sequence, H is the selected hash function and h is the resulting fixed-length digest. The comparison is meaningful only when the same bytes, algorithm and processing conditions are used. A hash is not encryption: it does not conceal the evidence, and a matching hash does not prove that the source itself was authentic before acquisition.

For verification, the examiner may calculate a digest of the source and the image, or calculate the digest during acquisition and again from the completed image. If the two digests match, there is strong evidence that the compared byte sequences are unchanged. If they differ, the examiner must not simply repeat the process until a match occurs; the cause must be investigated and documented.

Hash algorithms have different security properties. MD5 and SHA-1 remain encountered in legacy forensic systems and can be useful for continuity with older records, but modern procedures commonly include SHA-256 or a stronger approved algorithm. The selected algorithm should be documented, and organisational or legal requirements should be followed.

Hash verification is necessary but not sufficient. It does not prove that the correct device was selected, that the source was not altered before hashing, that hidden device areas were included or that the examiner's interpretation is correct. Verification should therefore be combined with photographs, identifiers, tool logs, write-blocker testing and chain-of-custody records.

8. Chain of Custody and Acquisition Documentation

Chain of custody is the chronological record of possession, handling, transfer, storage and examination. A useful record includes:

Time records should use an explicit time zone or Coordinated Universal Time. If a device clock is inaccurate, the offset should be measured where possible and reported rather than silently corrected in the original evidence.

Documentation should distinguish observation from interpretation. “The screen displayed an open command window” is an observation; “the suspect was executing a command” is an interpretation requiring additional evidence.

9. Tool Validation and Testing

9.1 Validation, verification and testing

These terms are related but not identical:

• Validation establishes that a tool is fit for a defined purpose in a defined environment.
• Verification checks that a particular operation or output corresponds to the source or expected result.
• Testing is the practical activity used to discover whether the tool behaves as expected.
• Accreditation or certification is a formal recognition process and does not automatically prove that every tool function is reliable.

A tool should never be treated as universally valid. It may be validated for one file system, operating-system version, image type or function but not for another.

9.2 A practical validation framework

A defensible validation programme includes:

1. Define the intended use. For example, acquisition of NTFS media, parsing of a specified browser database or collection of RAM from a specified operating system.
2. Define expected results. Use known test data whose files, timestamps, permissions, deleted items and artefacts are documented.
3. Control the environment. Record operating system, tool version, libraries, hardware, configuration and time settings.
4. Test normal and abnormal conditions. Include valid media, corrupted structures, unsupported formats, encrypted content, large files, Unicode names and boundary cases.
5. Use independent comparison. Compare with a trusted reference method, manual calculation, known-good tool or documented ground truth.
6. Record defects and limitations. A failed test is a finding, not an inconvenience to be hidden.
7. Approve a defined version. Updates can change parsing and acquisition behaviour; re-testing may be required.
8. Review periodically. New operating systems, file systems, attacks and vendor changes can invalidate prior assumptions.

A validation report should state the test identifier, purpose, setup, input, procedure, expected result, actual result, pass or fail decision, evidence retained, reviewer and limitations.

9.3 Test design and coverage

A small demonstration is not sufficient validation. Test data should include both positive and negative cases. For a file-system parser, for example, tests may include ordinary files, deleted files, alternate data streams, malformed metadata, time-zone changes, long paths, sparse files and records with unusual characters.

Where a tool produces a date, the examiner should check whether it represents creation, modification, access or metadata-change time, and whether the tool applies local-time or UTC conversion. Where a tool recovers a file, the examiner should check whether the result is complete, carved from content, reconstructed from metadata or only a directory entry.

Repeatability means that the same examiner using the same approved configuration obtains consistent results. Reproducibility means that another competent examiner can obtain materially equivalent results using the documented procedure. Both matter in court and in internal review.

9.4 Tool limitations and reporting

A tool may fail because of unsupported formats, damaged media, proprietary encryption, resource limits, parser defects or ambiguous source data. Examiners should record error messages and preserve logs. They should not silently convert an error into a conclusion such as “no evidence found.” The correct conclusion may be “the tool did not identify evidence under the tested conditions.”

Tool output is an aid to examination, not an unquestionable fact. Important findings should be corroborated where practical by another method, such as manual inspection of a database, independent hash calculation or comparison with operating-system documentation.

10. Applied Case: Illustrative Corporate Intrusion

Background

An organisation suspects that an administrator account was used to copy confidential design files from a workstation. The workstation is powered on, connected to the corporate network and protected by full-disk encryption. The organisation's incident-response authority permits collection of volatile and persistent evidence from the device.

Problem

Powering off the workstation may preserve the disk state but could make encrypted content inaccessible and destroy RAM-resident credentials or malicious code. Leaving it connected may allow an intruder or malware to alter evidence.

Analysis and approach

The examiner first records the screen, device identifiers, visible applications, time and network connections. With an incident commander authorised to approve containment, the device is isolated from the network using a controlled method that avoids unnecessary shutdown. The examiner uses a validated live-response tool to collect RAM, process information, logged-on users, open files and network state. The tool version, commands and output destination are recorded.

The examiner then shuts down the workstation according to the approved procedure, removes the storage device and connects it through a tested hardware write blocker. The physical media is imaged to an evidence container. The image is hashed using SHA-256, and verification is performed after imaging. A second working copy is created and independently verified before analysis.

The tool-validation file shows that the imaging tool was tested on the same storage interface and that the memory tool had been validated for the workstation's operating-system version. A limitation is recorded: the memory tool may alter a small amount of RAM while executing, and SSD garbage collection may have affected deleted-data recovery.

Outcome

The RAM image contains a command process, an active network session and a token associated with the administrator account. The disk image contains event records and a file-transfer utility, but deleted-file recovery is incomplete. The report distinguishes the observed artefacts from the conclusion that the account was used to copy files. Network logs and server-side access records are obtained separately to corroborate the finding.

Learning points

The case demonstrates why acquisition is an investigative decision rather than a mechanical procedure. Live collection preserved evidence that would otherwise have been lost, while network isolation reduced ongoing risk. Physical imaging preserved a broad source representation, but neither hashing nor imaging eliminated the limitations caused by encryption, SSD behaviour or live-tool effects.

11. Contemporary Developments

Modern acquisition increasingly involves mobile devices, virtual machines, containers, cloud services, Internet-of-Things devices and encrypted collaboration platforms. A single physical device may contain only authentication tokens while relevant content resides with a provider. Examiners may therefore need to combine endpoint imaging, API-based collection, provider preservation requests, identity logs and network telemetry.

Remote collection can be efficient but raises additional questions about authentication, jurisdiction, provider logging, clock accuracy and the risk of changing cloud data during collection. Virtual machines require attention to snapshots, virtual disks, hypervisor logs and host evidence. Containers may be short-lived, so orchestration logs and image registries can be as important as the container file system.

Artificial intelligence and automated classification can assist triage, identify likely relevant artefacts and prioritise large datasets. However, AI-generated classifications are not automatically evidence. The examiner must preserve the input data, model or service details where possible, confidence information, prompts or configuration, and a human-review process. Automation should not conceal uncertainty or replace validation.

12. Best-Practice Checklist

Before acquisition:

• confirm authority, scope and safety;
• identify the source and record its condition;
• select the least-changing method that answers the investigative question;
• confirm destination capacity and access controls; and
• check tool and write-blocker validation status.

During acquisition:

• avoid unnecessary interaction;
• record commands, settings, versions and times;
• preserve volatile evidence when justified;
• use a write blocker for compatible persistent media;
• monitor and record errors; and
• calculate and document appropriate hashes.

After acquisition:

• verify the image independently where practical;
• preserve the source and master image securely;
• create controlled working copies;
• complete chain-of-custody records;
• report limitations and failed tests; and
• ensure conclusions do not exceed what the acquisition supports.

Chapter Summary

Forensic acquisition creates a controlled and documented representation of digital evidence. Volatile data may require live acquisition, while persistent media is commonly collected through dead-box physical or logical methods. The choice depends on evidence value, system state, encryption, risk, authority and technical capability. Write blockers reduce the risk of source modification but must themselves be tested and validated.

Cryptographic hashes support integrity comparison, but they do not prove source authenticity or eliminate the need for documentation. Chain-of-custody records, photographs, tool logs, identifiers and secure storage establish accountability and reproducibility. Tool validation must be purpose-specific, based on known test data, controlled environments, expected results, abnormal cases and independent comparison. Limitations, errors and version changes must be reported honestly. Contemporary investigations increasingly combine endpoint, memory, cloud, mobile and automated methods, making legal scope, privacy, validation and professional judgement essential.

Key Terms

Volatile evidence: Digital information that may disappear or change when power or system operation changes.

Non-volatile evidence: Information retained on persistent storage after shutdown.

Live acquisition: Collection performed while a system is powered and operating.

Dead-box acquisition: Collection performed after a device has been powered off or stopped.

Logical acquisition: Collection of selected files, folders or application records.

Physical acquisition: A broad, addressable-storage-level copy that may include deleted and unallocated areas.

Write blocker: A hardware or software control intended to prevent writes to source media.

Forensic image: A documented representation of data from a source device or storage system.

Hash: A fixed-length digest calculated from data using a hash function.

SHA-256: A widely used cryptographic hash algorithm producing a 256-bit digest.

Chain of custody: The chronological record of evidence possession, handling and transfer.

Validation: Establishing that a tool is fit for a defined purpose and environment.

Verification: Checking that a particular operation or output matches an expected or source result.

Ground truth: A known or independently established result used for testing.

Repeatability: Consistency of results under the same conditions.

Reproducibility: Ability of another competent examiner to obtain materially equivalent results.

Unallocated space: Storage areas not currently assigned to active files by a file system.

Order of volatility: A collection strategy that generally prioritises evidence most likely to disappear.

Tool limitation: A documented condition under which a tool may fail, omit or misrepresent information.

Review Questions

Short Answer Questions

1. Distinguish volatile evidence from non-volatile evidence and give two examples of each.
2. What is the purpose of a write blocker?
3. Why should an examiner document the tool version used for acquisition?
4. What does a matching cryptographic hash demonstrate, and what does it not demonstrate?
5. Identify four items that should appear in a chain-of-custody record.

Long Answer Questions

1. Explain how an examiner should decide between live and dead-box acquisition for an encrypted workstation.
2. Describe a complete physical-imaging procedure from device identification through secure storage.
3. Explain the difference between validation, verification, testing, repeatability and reproducibility.
4. Discuss the technical and evidential limitations of acquiring deleted data from solid-state storage.
5. Evaluate the legal, ethical and governance issues involved in acquiring employee or cloud-hosted data.

Analytical / Application Questions

1. A powered-on laptop contains suspected malware and uses full-disk encryption. Design an acquisition plan, justify the order of actions and identify at least three limitations.
2. An imaging tool reports a successful acquisition, but the verification hash differs from the acquisition hash. Analyse possible causes and specify the steps that should follow.
3. A forensic parser identifies no browser history in an image, but an independent database viewer displays records. Explain how you would investigate the discrepancy and report the result.

Multiple Choice Questions with Answers

Question 1

Which item is normally considered volatile evidence?

A. A partition table

B. A file stored on a powered-off disk

C. A running process list in RAM

D. A sealed forensic image

Correct Answer: C. A running process list in RAM

Question 2

What is the primary purpose of a forensic write blocker?

A. To encrypt the evidence source

B. To prevent writes to the source medium

C. To recover deleted files automatically

D. To calculate a password

Correct Answer: B. To prevent writes to the source medium

Question 3

Which acquisition method is most appropriate when encryption keys may exist only in memory?

A. Live acquisition

B. Dead-box acquisition only

C. Logical acquisition from a sealed disk

D. Destruction of the source device

Correct Answer: A. Live acquisition

Question 4

In h = H(M), what does h represent?

A. The source device capacity

B. The cryptographic digest of the data

C. The hash algorithm's source code

D. The acquisition time

Correct Answer: B. The cryptographic digest of the data

Question 5

Which statement about a matching hash is correct?

A. It proves who created the data

B. It proves the examiner interpreted the data correctly

C. It provides evidence that the compared byte sequences are unchanged

D. It guarantees that no data was missing from the original device

Correct Answer: C. It provides evidence that the compared byte sequences are unchanged

Question 6

Which activity is a component of tool validation?

A. Testing only one successful example

B. Defining expected results using known test data

C. Ignoring errors produced on unsupported media

D. Assuming a vendor claim applies to every function

Correct Answer: B. Defining expected results using known test data

Question 7

Why is a physical acquisition generally broader than a logical acquisition?

A. It collects only visible user files

B. It may include unallocated and deleted areas

C. It cannot contain file-system metadata

D. It always bypasses encryption

Correct Answer: B. It may include unallocated and deleted areas

Question 8

What should an examiner do when a tool produces an acquisition error?

A. Hide the error if the image opens

B. Repeat the process until the error disappears without recording it

C. Record and investigate the error and its effect

D. Treat the error as proof that no evidence exists

Correct Answer: C. Record and investigate the error and its effect

Question 9

Which statement best describes reproducibility?

A. The same examiner obtains consistent results under identical conditions

B. Another competent examiner can obtain materially equivalent results from the documentation

C. A tool has a marketing certificate

D. A hash is calculated only once

Correct Answer: B. Another competent examiner can obtain materially equivalent results from the documentation

Question 10

What is a significant limitation of deleted-file recovery from many SSDs?

A. SSDs cannot store file metadata

B. Wear levelling and TRIM may make deleted data unavailable

C. SSDs always preserve deleted data indefinitely

D. A write blocker automatically restores deleted sectors

Correct Answer: B. Wear levelling and TRIM may make deleted data unavailable