# Core Forensics Principles

To be a successful digital investigator, you must understand two fundamental principles that guide how and when we collect evidence.

---

## 1. Locard's Exchange Principle
Dr. Edmond Locard was an early pioneer in forensic science. His principle states:

> *"Every contact leaves a trace."*

In the physical world, if a burglar enters a house, they might leave behind DNA, shoe prints, or fabric fibers. Conversely, they take things away with them—carpet fibers on their shoes, or a victim's blood on their clothes.

**In the Digital World:**
When an attacker breaches a server, they *always* leave a trace, and they *always* alter the environment.
*   **What they leave:** IP addresses in Apache logs, malicious binaries dropped in `/tmp`, newly created user accounts, or modified registry keys.
*   **What they take:** Exfiltrated database files, stolen SSH keys.

The trace is always there. The job of the forensic analyst is simply to know where to look for it before it gets overwritten.

---

## 2. The Order of Volatility (RFC 3227)
You arrive at a compromised server. It's powered on. Do you unplug it immediately? Do you copy the log files first? Do you dump the RAM?

Evidence must be collected based on its **Volatility** — how easily and quickly it can be lost or destroyed. You must gather the most volatile evidence first, moving down to the least volatile evidence.

### The Standard Order of Volatility:
*(From Most Volatile / First Collected → to Least Volatile / Last Collected)*

1.  **Registers and Cache:** Data inside the CPU. (Extremely hard to capture, often ignored in standard IR).
2.  **Routing Tables, ARP Cache, Process Table, Kernel Statistics:** This lives in RAM mapping active network/process states. It changes every millisecond.
3.  **System Memory (RAM):** The contents of the running memory. If power is lost, this is gone forever.
4.  **Temporary File Systems:** E.g., The `/tmp` directory in Linux, which is often cleared upon a reboot.
5.  **Disk (Hard Drive / SSD):** Persistent storage. Files, databases, and logs. This will survive a reboot.
6.  **Remote Logging and Monitoring Data that is relevant to the system in question:** E.g., Logs forwarded to a SIEM.
7.  **Physical Configuration and Network Topology:** The physical layout of cables and routers.
8.  **Archival Media:** Backups stored on tapes or in cold cloud storage.

### The "Pull the Plug" Debate
In the old days, responders were trained to "pull the power plug" on a compromised machine immediately to stop the attacker. 

**Today, pulling the plug is considered bad practice in most situations.** 
Why? Because modern malware, like advanced ransomware or fileless trojans, often live *only* in RAM. If you pull the plug, you destroy the RAM, and you destroy the only evidence of the malware and its decryption keys. 

Instead, modern responders isolate the machine from the network (so the attacker loses access) and immediately image the RAM, securing the most volatile evidence first.