Windows 11 workstation WKS-ACCT-23 records an impossible login at 2026-10-14 09:12 UTC, followed by suspicious process execution through 10:05 UTC. An attacker may have needed only valid credentials and a remote logon path, not malware that visibly breaks the workstation. Within authorized incident-response scope, we must determine what the disk and memory can support, while preserving evidence so another examiner can test every conclusion. The evidence items are EVD-2026-1014-001, a disk image, and EVD-2026-1014-002, a memory capture. The evidence path below shows where custody controls must hold:
This diagram separates the original workstation from the analyst environment and evidence vault. Each acquisition, transfer, storage, and analysis boundary creates an opportunity to alter, lose, or misattribute evidence, so each boundary needs a recorded handler, time, location, and integrity check.
The forensic process turns the two collected files into defensible findings through identification, preservation, collection, examination, analysis, and reporting. Identification fixes the incident scope, including WKS-ACCT-23, the suspicious interval, and the authority to handle the device. Preservation prevents changes to original evidence. Collection creates controlled copies. Examination extracts artifacts such as Windows event records, process metadata, and memory structures. Analysis connects those artifacts to claims, while reporting distinguishes supported conclusions from unanswered questions.
Collection order matters because volatile data disappears while the workstation remains powered on. RFC 3227, BCP 55, establishes the order-of-volatility principle: collect information likely to change first, then move toward more persistent evidence. For WKS-ACCT-23, the memory capture EVD-2026-1014-002 can preserve running processes, network connections, and in-memory credentials that a shutdown would destroy. The disk image EVD-2026-1014-001 preserves persistent files and file-system metadata, but a disk image cannot recreate a process that has already exited.
Skipping preservation breaks the chain before examination begins, because analyst activity may change timestamps or overwrite temporary artifacts. Skipping examination produces a pile of data without extracted evidence. Skipping analysis turns artifact observations into unsupported narrative. The process is not a rigid claim that every incident follows identical steps, but each departure must be recorded with its reason and consequence.
Exam rule
Capture the most volatile relevant evidence first, and document why a different order was necessary.
Once EVD-2026-1014-001 and EVD-2026-1014-002 exist, a chain of custody is the chronological record showing what each item is, who handled it, where it resided, and how integrity was checked. The record assigns stable evidence IDs before analysis begins. A meaningful description distinguishes a disk image from a memory capture, while UTC timestamps allow transfers to be aligned with the suspicious activity window.
Integrity depends on a cryptographic hash, a fixed-length digest computed from an evidence file. If the acquired disk image produces one SHA-256 digest and a later verification produces a different digest, the examiner cannot claim the later file is unchanged. The commonly tested mistake is hashing only once at acquisition. We verify the hash at acquisition, before and after transfer, when retrieving the item for analysis, and when returning it to controlled storage.
The custody entries for both evidence items show the minimum record needed for later review: