The first two units built tools that act on a system: a scanner that knocks on doors, an SSH client that runs commands, a credential tester that tries logins. This unit turns that around. Every script here examines a system without disturbing it, because the moment digital forensics touches evidence it must be prepared to explain exactly what it touched and why.
Analogy: The crime scene
A forensic investigator arriving at a crime scene does not rearrange the furniture, wipe the surfaces, or pocket a souvenir. They photograph everything first, touch as little as possible, bag each item with a signed label, and record who handled what and when. Digital forensics applies the same discipline to data: recover and examine it in a way that would survive a challenge in court.
Key takeaway: The one rule
The whole craft rests on one rule: do not alter the evidence. Every Python script in this unit is written to read and copy, never to change. You will see this rule shape almost every design decision ahead, from copying a file before opening it to choosing which timestamp a script is allowed to touch.
A recognised process, not improvisation
A forensic investigation follows a process, and every script in this unit plays a part in one of its stages.
Python concept: The digital forensic investigation process
- Identify: locate the devices and data that may hold evidence.
- Preserve: protect the originals; work only from verified copies.
- Collect: acquire the evidence in order of volatility, most fleeting first, hashing each item as it is collected.
- Examine: extract the relevant content and metadata without altering the source.
- Analyse: correlate the findings, often onto a single timeline.
- Report: present the findings and the method clearly enough to withstand challenge.
Vocabulary: Chain of custody
A documented record of who collected a piece of evidence, when, how it was stored, and who accessed it afterward, like the signature log on a sealed evidence bag. A script that logs its own actions, the file it read, the hash it computed, the time it ran, contributes directly to this record. The next article builds exactly that logger, and every later script in this unit calls it.
Collect the fleeting things first
Vocabulary: Order of volatility
The principle that the most fleeting evidence is collected first. Data in RAM vanishes the moment a machine powers off; a file's last-access time can change the moment an investigator opens it; data on a write-protected image is stable. Collect from the top of the pyramid down.
RAM
Vanishes the moment a machine powers off. Running processes, open network connections, decrypted contents in memory: gone forever at shutdown.
Temporary files, logs
Overwritten or rotated on a running schedule, sometimes within hours.
Disk files, archived data
The canned goods. Stable until something is deliberately written over the same space.
How this rule shapes every script ahead
Why it carries weight: Why it carries weight
This unit shifts the book from building tools that act on systems to building tools that examine them without disturbance, which is a different frame of mind. A script that copies a database before reading it, hashes a file before and after moving it, or reads a timestamp without opening the file first is not being cautious for its own sake; it is following the order of volatility and the chain-of-custody rule from this article. You will meet all three habits in the articles ahead.
Case study: Why a script's own log matters as much as its finding
An investigator presents a timeline showing a suspicious file was modified before a login occurred. Opposing counsel asks: how do you know the examination itself did not change that timestamp? Without a log, there is no answer but trust. With one, the investigator shows the exact moment the file was copied, read-only, before any analysis began, and the hash computed at collection matching the hash computed before presentation. The finding is the same either way; only the second version survives the question. This scenario is illustrative, but the underlying demand, prove you did not disturb what you are presenting, is real in every forensic process.
Check your understanding
Question 1: Using the freezer analogy, explain the order of volatility and give one example of evidence that must be collected before a file's last-access time.
The order of volatility says to collect the most fleeting evidence first, the way ice cream has to be dealt with before canned goods spoil. The contents of RAM, such as running processes or network connections, must be collected before a file's last-access time, because RAM disappears completely the instant the machine is powered off, while an access time merely changes and can still be read, just not to its original value.
Question 2: What does a chain of custody actually document, and what role does a script's own log file play in it?
It documents who collected a piece of evidence, when, how it was stored, and who accessed it afterward. A script's log file records exactly this for its own actions, the file it touched, the hash it computed, the timestamp it ran, so the log becomes part of the chain of custody rather than something separate from it.
Question 3: Why does this unit insist that every script reads and copies, but never changes, the evidence it touches?
Because an investigation's findings only hold up if the examination itself can be shown not to have altered what was found. A script that modifies evidence while examining it destroys the ability to prove the evidence is in its original state, which is the one thing a forensic examination can never recover once lost.
Key takeaway: Key takeaway
Digital forensics is examination without disturbance, carried out through six recognised stages: identify, preserve, collect, examine, analyse, report. Collect the most volatile evidence first, and let every script log its own actions, because an undocumented action is of little use as evidence.