Certified: The GIAC GSLC Audio Course

In this episode, we focus on preserving evidence so your decisions, actions, and conclusions survive scrutiny later, whether that scrutiny comes from executives, auditors, regulators, counsel, or a court. In the middle of an incident, the instinct is to fix the problem fast, and that instinct is understandable, but fast fixes can destroy the very artifacts you need to understand what happened and to prove what you did. Evidence preservation is not a luxury for high-profile cases; it is a practical discipline that makes incident response more effective because it improves scoping, supports containment decisions, and reduces rework during recovery. It also protects the organization by ensuring that key facts are reconstructable after the pressure has passed, which is essential when reputational and legal outcomes depend on what you can demonstrate. The goal is not to turn every incident into a full forensic investigation, but to ensure the option exists when you need it. When evidence is preserved well, you can move quickly and still remain defensible.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

Chain of custody is the concept that makes evidence handling credible, and the simplest definition is documented evidence handling from collection through storage and analysis. It means you can show what evidence was collected, when it was collected, where it was stored, who accessed it, and what changes were made to it, if any. The point is not paperwork for its own sake; the point is trust. If you cannot demonstrate that evidence was handled in a controlled way, someone can argue that it was altered, contaminated, or misattributed, and that argument can undermine investigations and decision justification. Leaders should frame chain of custody as an operational control that protects the organization, not as a forensic formality. It is especially important in insider-related cases, because internal disputes often hinge on whether evidence is credible and whether handling was unbiased. A disciplined chain of custody also helps your own team, because it prevents confusion about which copy is authoritative and which artifacts were used to draw conclusions. In a busy incident, that clarity is worth a lot.

To preserve evidence effectively, you need to know where evidence lives across hosts, networks, and services, because incidents rarely produce all relevant data in one place. On hosts, evidence can include system logs, authentication records, process execution traces, file system metadata, persistence mechanisms, and security tool telemetry. On networks, evidence can include flow records, firewall decisions, proxy logs, Domain Name System (D N S) resolution records, and intrusion detection events. In services, evidence can include cloud audit trails, identity provider events, application logs, access tokens, and configuration change histories. Leaders should encourage teams to think in layers: endpoint, identity, network, application, and platform, because attackers traverse layers and leave partial traces in each. You also want to consider where evidence is centralized versus local, because local logs can be wiped or rotated quickly, while centralized logging may preserve longer history but might lack fine detail. The most important point is that evidence sources should be identified before the incident, because during the incident you will not have time to guess what exists and where it is.

Volatile data deserves special attention because it disappears quickly, and if you miss it, you may never get it back. Volatile data includes information held in memory, current running processes, active network connections, open files, session tokens in use, and other transient state that can vanish with a reboot, a crash, or a containment action like isolation. Capturing volatile data early can be the difference between confirming attacker tooling and guessing at it later. Leaders should understand the tradeoff. Capturing volatile data can take time and can introduce risk if it delays containment, so the right approach is to define what is worth capturing quickly and how to do it safely. In many cases, a small, rapid volatile capture is possible while containment steps are being coordinated. The discipline is to recognize when a system is about to change state and to capture what you can before that change happens. If you isolate or power down first without thought, you may protect the business from spread but lose the ability to understand initial access or lateral movement, which can create longer-term risk.

Evidence handling is only defensible when you record who touched evidence and when, because access and handling are part of the evidence story. Recording this is not a complicated concept. You document the collector, the time, the system source, the storage location, and any transfers of custody between people or systems. You also document the purpose, such as triage, deep analysis, or legal hold, because purpose helps justify why evidence was accessed. Leaders should insist that teams treat evidence access as a privileged action, because it often contains sensitive information and because evidence can become contested. The record also reduces internal confusion. When multiple responders collect artifacts and share them informally, it becomes unclear which copy is original, which copy is edited, and which copy was used to make decisions. A simple handling record eliminates that ambiguity. In insider cases, it can also protect the responder team by showing that access was appropriate, bounded, and documented. Credibility is built through repeatable discipline, not through claims of good intent.

One of the most damaging pitfalls is changing systems before collecting key artifacts, because many normal response actions modify evidence. Rebooting clears memory, reimaging overwrites disks, patching changes files, and even logging into a system can update timestamps and write new entries. Some changes are necessary for containment and recovery, but the mistake is making changes without first capturing the minimum evidence that you will later wish you had. Leaders should encourage responders to ask a simple question before taking a disruptive action: what evidence will this destroy, and do we need it. This does not mean paralysis. It means you capture what is fast and high value, then you act. When you consistently do this, you preserve the ability to build a reliable timeline and confirm root cause, which reduces the risk of reoccurrence. If you do not do it, you may contain the incident but be forced to keep systems offline longer because you cannot confidently declare them clean. Evidence preservation supports recovery speed by reducing uncertainty.

A quick win is to standardize collection steps and storage locations, because improvisation during incidents leads to missed artifacts and inconsistent handling. Standard steps might include a short set of evidence to capture for common incident types, such as credential compromise, malware detection, ransomware activity, or insider suspicion. Standard storage locations mean you have a controlled place to put artifacts where access is logged, retention is defined, and integrity is maintained. Leaders should emphasize that the storage location must be hardened, because evidence often contains sensitive data and because evidence integrity matters. Standardization also improves training. New responders can follow a repeatable path, and experienced responders can move faster because they do not reinvent the process each time. It also helps with legal and compliance coordination because you can explain the evidence handling process as a consistent practice rather than as a one-off improvisation. When collection and storage are standardized, the organization becomes forensics-ready by default rather than relying on a few experts to remember what to do.

Insider suspicion scenarios demand especially careful preservation because the stakes are not only technical, but also human and legal. In a scenario where an insider is suspected of misuse, you want to avoid contaminating evidence through informal handling, and you want to ensure neutrality in your process. That means strict chain of custody, controlled access to artifacts, and careful documentation of every step. It also means limiting who is aware of the suspicion, because premature disclosure can lead to evidence destruction or retaliation concerns. Leaders should coordinate with legal and human resources early in such cases, because investigative boundaries and employee rights can shape what actions are appropriate. Technically, you may focus on access logs, data movement events, privilege use, and unusual authentication patterns, but the bigger point is process integrity. If your evidence handling appears sloppy or biased, conclusions will be challenged even if they are correct. If your evidence handling is disciplined and documented, the organization can make decisions confidently and defensibly. Process is part of the control in insider cases.

Log time synchronization is an essential prerequisite for reliable timelines, because an incident timeline is only as accurate as the timestamps it is built from. If different systems disagree about time, you can misorder events, misattribute cause, and miss critical relationships between actions. This is why time synchronization should be treated as a baseline operational control rather than as a technical nicety. Leaders should ensure that systems rely on consistent time sources and that drift is monitored, especially for high-value systems like identity providers, security tooling, and critical applications. When time is aligned, you can correlate authentication events with network traffic, process execution with file changes, and administrative actions with service behavior. When time is not aligned, correlation becomes guesswork and investigations become slower and less reliable. Time sync also matters when legal and regulatory scrutiny arrives, because inconsistent time records can undermine credibility. A simple investment in time discipline repays itself every time you have to reconstruct what happened across multiple platforms.

Separating investigative accounts from normal administrative accounts is another discipline that strengthens evidence handling and reduces risk during response. Investigative accounts are identities used specifically for collecting evidence and performing controlled analysis, with permissions designed for observation and capture rather than broad modification. Normal administrative accounts are often powerful and are used for routine operations, which makes their activity harder to distinguish and increases the risk of accidental changes during investigation. When you separate these, your audit trails become clearer because investigative actions are attributable to specific roles and purposes. It also improves safety because investigative accounts can be configured with constraints that reduce the chance of accidental destructive actions. Leaders should care about this because during incidents, teams are stressed and mistakes are more likely. Clear separation reduces ambiguity and protects the integrity of evidence. It also supports later review, because you can see which actions were investigative and which were remedial. Separation is a simple design choice that produces better accountability and cleaner forensics outcomes.

A memory anchor that keeps evidence discipline simple is collect, label, store, document, and verify always, because each word points to a step that must not be skipped. Collect means gather relevant artifacts quickly and safely before they disappear. Label means identify what the artifact is, where it came from, and when it was collected, so it stays meaningful. Store means place it in a controlled, hardened location that preserves integrity and access records. Document means record handling and transfers so chain of custody is defensible. Verify means confirm integrity, completeness, and relevance, including checking that the artifact you stored is readable and corresponds to the right system and time period. Leaders can repeat this anchor in training and in live response because it is short, clear, and actionable. When teams internalize it, evidence handling becomes a habit rather than a special request. Habits perform well under stress, and evidence preservation is exactly the kind of work that must function under stress.

A critical part of readiness is validating logging coverage before incidents, not during, because discovering gaps during a breach is an avoidable failure. Logging coverage includes whether the right events are collected, whether they are retained long enough, whether they are centralized, and whether they are protected from tampering. It also includes whether the logs are useful, meaning they have enough context to answer questions like who accessed what, from where, and using which identity. Leaders should ensure that critical systems have adequate audit trails, especially identity systems, privileged access pathways, and data movement systems. They should also ensure that retention aligns with investigation needs and regulatory expectations, because short retention can make root cause analysis impossible. Validating coverage can be done through periodic reviews, simulated incidents, and spot checks where teams try to reconstruct a timeline using available logs. If the reconstruction is difficult, the logs are not ready. Readiness means you can answer key questions quickly, and logging is the foundation for those answers.

As a mini-review, it is useful to list three evidence sources and the controls that make them credible, because this reinforces the connection between data and defensibility. One evidence source is endpoint host artifacts, supported by controlled collection methods, minimal system disturbance, and documented chain of custody. A second evidence source is network and security telemetry, supported by centralized logging, time synchronization, and retention that preserves the period of interest. A third evidence source is cloud and service audit trails, supported by protected access, tamper resistance, and clear separation of investigative identities from routine administrative identities. The point is not to memorize every possible artifact. The point is to know that evidence lives across layers and that credibility comes from disciplined handling and reliable logging. Leaders who can state this clearly can justify investments in logging and evidence handling as operational risk reduction, not as a niche technical preference. This framing helps secure resources before incidents rather than trying to argue for them during crises.

In conclusion, pick one logging gap to close now, because small improvements in logging readiness often have disproportionate value during real incidents. The gap might be missing audit logs for privileged actions, short retention that deletes key evidence too quickly, lack of centralization that leaves logs scattered across systems, or poor time synchronization that makes correlation unreliable. The goal is to choose a gap that affects your ability to answer core incident questions and to improve it in a measurable way. Evidence preservation is not only about catching attackers; it is about proving what happened and proving what you did in response. When you have disciplined chain of custody, standardized collection and storage, time-synced logs, and clear investigative identities, you can act quickly without losing defensibility. That combination protects the organization technically and institutionally, because it reduces both operational harm and the uncertainty that drives costly overreaction. Close the one gap, reinforce the habit of collect, label, store, document, and verify always, and you will materially improve your incident response capability.