Incident Response and Forensics
Order is what these questions test. The phases run in one sequence, evidence is collected most volatile first, and getting either backwards is the wrong answer even when every individual step is right.
Incident Response and Forensics · firsttry.app/cheatsheets/incident-response · original reference written from published exam objectives. Not affiliated with any certification body.
The six phases, in order
| Phase | What happens | Common mistake |
|---|---|---|
| 1. Preparation | Plans, tooling, training, contacts | Treating this as not part of the response |
| 2. Detection and analysis | Confirm it is real, scope it | Acting before scoping |
| 3. Containment | Stop the spread, short and long term | Wiping before evidence is captured |
| 4. Eradication | Remove the cause, not the symptom | Reimaging without finding the entry point |
| 5. Recovery | Restore and monitor | Restoring from a backup taken after compromise |
| 6. Lessons learned | Written up, feeds preparation | Skipping it once service is back |
Order of volatility
| Order | Source | Why here |
|---|---|---|
| 1 | CPU registers and cache | Gone in nanoseconds |
| 2 | RAM, running processes, network connections | Gone at power off |
| 3 | Temporary files and swap | Overwritten during normal use |
| 4 | Disk | Survives reboot |
| 5 | Remote logging and monitoring data | Held elsewhere, but rotates |
| 6 | Physical configuration and topology | Stable |
| 7 | Archival media and backups | Most stable |
Evidence handling
| Term | What it means |
|---|---|
| Chain of custody | Unbroken record of who held evidence and when |
| Legal hold | Duty to preserve data once litigation is anticipated |
| Write blocker | Reads a drive without altering it |
| Forensic image | Bit-for-bit copy, work from this rather than the original |
| Hashing the image | Proves the copy has not changed since acquisition |
| e-discovery | Locating and producing electronic evidence |
| Provenance | Where the data came from and how it got there |
| Data acquisition order | Follow order of volatility, document as you go |
Exercise types
| Exercise | What it involves |
|---|---|
| Tabletop | Discussion around a scenario, no systems touched |
| Walkthrough | Step through the plan, roles confirmed |
| Simulation | A realistic event is staged and responded to |
| Parallel test | Recovery systems brought up alongside production |
| Full interruption | Production is actually failed over. Highest risk |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.