Acquisition in Digital Forensics: Security+ and CySA+ Exam Prep
Security+ SY0-701 Domain 4.8 · CySA+ CS0-004 Incident Response & Management
Acquisition is the moment digital forensics either succeeds or quietly fails. It's the step where an analyst captures evidence from a live or compromised system — and if that capture is done sloppily, every conclusion built on top of it is worthless, no matter how good the later analysis is. Security+ tests whether you know what proper acquisition looks like. CySA+ tests whether you can make the right acquisition call under the pressure of an active incident. This article covers both.
What acquisition actually means
In the forensic process, acquisition is the step where data is copied from its original source — a hard drive, RAM, a network device, a cloud service — into a form that can be preserved and analyzed without altering the original. It sits right after evidence is identified and before it's formally analyzed, and it's the step where forensic soundness is either established or lost for good. Once a volatile data source is gone (a process ends, a system reboots, memory clears), there is no second attempt — which is exactly why both exams treat acquisition as a high-stakes, order-sensitive activity rather than a routine copy job.
Order of volatility: why sequence matters
The organizing principle behind acquisition is capturing the most fragile, fastest-changing data first. CPU registers and cache disappear in fractions of a second; RAM and running process data survive only as long as the system stays powered; temporary files, swap space, and network connection state are next; and data on disk, backups, and archived logs are comparatively durable and can wait. An analyst who images a hard drive first and only then thinks about capturing memory has likely already lost the most valuable evidence — the state of a running attack — in favor of the data that would have kept just fine either way. This ordering logic is the reason live acquisition exists at all: some evidence simply won't survive being second in line.
Security+ level: recognizing sound acquisition
Security+ objective 4.8, Digital Forensics, expects you to recognize the components of a properly handled acquisition rather than perform one yourself:
- Data sources — acquisition can pull from disk, memory, firmware, the file system, network devices, and virtual machine snapshots, and each source behaves differently in terms of volatility and how it's captured.
- Live acquisition — collecting data from a system while it's still running, which matters most when a device is encrypted and powering it down would make the data unrecoverable.
- Chain of custody and integrity — every piece of acquired evidence needs a documented chain of custody, and hashing (comparing a cryptographic hash before and after acquisition) is how an analyst proves the copy matches the original bit for bit.
- Legal hold — a legal directive, usually issued by counsel, that requires specific data to be preserved and protected from routine deletion once litigation or investigation is reasonably anticipated.
- Documentation and e-discovery — every acquisition step gets recorded in detail, and in a legal context that data may need to move through e-discovery: collecting, reviewing, and producing electronic evidence for a case.
The exam angle here is usually definitional: given a description of an acquisition activity, identify which concept it illustrates, or identify what's missing from a flawed procedure (an acquisition performed with no hashing, for instance, has no way to prove integrity later).
CySA+ level: making the acquisition call mid-incident
CySA+'s incident response objectives put "evidence acquisitions" inside the detection-and-analysis phase of active incident handling, alongside chain of custody, validating data integrity, preservation, and legal hold — the same building blocks Security+ names, but now applied under time pressure with competing priorities. Where CySA+ pushes further:
- Live vs. static acquisition trade-offs — a compromised, still-running host holds volatile evidence (memory, active connections, running processes) that a shutdown destroys, but leaving it running also lets an active attacker continue acting. CySA+ scenarios expect you to weigh evidence preservation against ongoing containment needs, not just recite the concept.
- Imaging with a write blocker — creating a forensic image (a bit-for-bit copy) using hardware or software that physically prevents any write operation to the original media, so the acquisition process itself can't be the thing that contaminates the evidence.
- Validating integrity before and after — hashing the source before acquisition and the resulting image after, then confirming they match, is treated as a required step in the workflow, not an optional nicety.
- Feeding into forensic analysis — acquisition isn't the end goal; it's the input to forensic analysis, which CySA+ places explicitly in the post-incident activity phase, tying root-cause analysis and lessons learned back to how well the original evidence was captured.
Why acquisition mistakes are unrecoverable
This is the thread connecting both exams' emphasis on the topic: acquisition errors don't get a do-over. Power off a system before capturing memory, and that volatile evidence is gone permanently. Skip the pre-acquisition hash, and there's no way to later prove the image wasn't altered — which can be enough to get evidence excluded in a legal proceeding. Acquire from a device without a write blocker, and a defense argument that the evidence was contaminated during collection becomes much harder to refute. Every other forensic step (analysis, reporting, even the incident response itself) assumes the acquisition was done right, which is exactly why both exams weight it so heavily relative to how simple the underlying idea sounds.
A worked scenario
A typical CySA+-style item: "During an active ransomware incident, an analyst must decide whether to immediately power down an infected server to stop lateral movement, or keep it running long enough to capture memory. The server is not the only path an attacker could use to move further into the network. What is the best course of action?"
The best answer captures volatile memory first — using a live acquisition technique — while applying other containment measures (network isolation, disabling the compromised account or interface) that stop lateral movement without requiring a shutdown. Powering the system down immediately destroys memory-resident evidence that may be the only record of the attacker's live activity, and the scenario's detail about other containment paths existing is the clue that isolation, not shutdown, is available as the immediate control.
Exam-day takeaways
- Acquisition is the forensically sound copying of evidence from its original source — get it wrong, and nothing downstream can be trusted.
- Order of volatility drives acquisition sequence: capture the most fragile data (registers, RAM, network state) before durable data (disk, backups, archives).
- Security+ tests recognition of the pieces: data sources, live acquisition, chain of custody, hashing, legal hold, documentation, e-discovery.
- CySA+ tests the judgment call: live vs. static acquisition trade-offs, write-blocked imaging, and integrity validation, all under active incident pressure.
- If a scenario needs both evidence preservation and stopping an active attacker, look for an answer that isolates or contains without requiring an immediate shutdown — that's usually the acquisition-preserving choice.
Sources:
No comments:
Post a Comment