Incident › Module 4 › Lesson 3
Evidence Hygiene
Evidence hygiene literacy names chain of custody, hash verification, write-blockers, and legal hold — document handling on YOUR $IR_LAB fictional evidence sets.
Visual · t34_evidence_hygiene
Evidence hygiene literacy. $IR_LAB only. Original Cyberlium.
Opening
Evidence spoiled is case lost — literacy teaches handling habits so tabletop chain-of-custody notes match production standards on lab artifacts you control.
Evidence hygiene covers acquisition — write-blockers for disk images, memory capture order, log preservation before rotation. Chain of custody logs who touched evidence when and why. Hash verification proves integrity — SHA-256 before and after transfer. Legal hold pauses deletion on relevant systems. Cyberlium writes evidence hygiene checklist on YOUR $IR_LAB — custody row for one fictional disk image and log export. Next: Detection Lab.
1. Evidence handling (named)
Acquisition: minimize alteration — volatile data first, then disk. Custody log: date, handler, action, hash. Integrity: SHA-256 documented at collection and storage. Storage: encrypted, access-controlled, retention per policy. Legal hold: notify custodians, suspend auto-delete.
On $IR_LAB, write custody row — artifact name, handler, hash placeholder, storage path under t34-ir.
Command guide
Try these commands — Evidence handling (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why hygiene protects legal outcomes and trust
Broken chain of custody inadmissible in court. Unhashed images challenged as tampered. Students practice custody on paper before touching production forensic kits.
Lab artifacts are fictional — habits still mirror production discipline.
3. Lab boundary
Forbidden: collecting evidence from stranger systems or live victims without authorization. Allowed: evidence hygiene card — custody and hash fields for $IR_LAB fictional artifacts.
Ship: evidence hygiene card for YOUR lab artifacts. Next: Detection Lab.
4. What you ship: evidence hygiene card for $IR_LAB
Custody row, hash field, storage note. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Evidence hygiene card. $IR_LAB named. File t34-m04-l03-evidence-hygiene.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip custody log because 'it's just lab.' Image disk without hash verification.
Right
Write evidence hygiene card for YOUR $IR_LAB. Next: Detection Lab.
Mission: document evidence hygiene on YOUR lab
1) List acquisition, custody, hash, storage, legal hold. 2) Write custody row for one fictional artifact. 3) Note chmod 600 on evidence notes path. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hash at collection — if you cannot prove integrity, analysis conclusions weaken.
Knowledge Check
APPLY: Chain of custody primarily documents:
Multiple choice
Knowledge Check
APPLY: True or False: SHA-256 hashes verify evidence integrity at transfer points.
True or False
Knowledge Check
APPLY: Evidence hygiene literacy on Cyberlium uses:
Multiple choice