Ensuring Data Integrity in Incident Response
Source: YouTube · SANS Digital Forensics and Incident Response · published Aug 15, 2025 · 34:04
BLUF: This presentation addresses the critical importance of data integrity in Digital Forensics and Incident Response (DFIR) by highlighting limitations of standard log collection and demonstrating how to build custom tools for forensically sound extraction 0:07.
Key Takeaways:
• The speaker outlines the agenda, emphasizing why log quality is paramount during DFIR investigations to ensure evidence validity 0:15.
• A major focus is placed on the technical limitations and potential data corruption issues encountered when collecting logs directly from web application interfaces 0:21.
• The talk provides a walkthrough on scripting custom log collection tools using documented APIs to bypass the reliability issues associated with web-based exports 0:33.
• Alternative techniques are discussed for scenarios where no documented API exists, utilizing web application hacking methods to extract logs effectively 0:45.
Effective log extraction is essential for maintaining the chain of custody and ensuring that forensic evidence remains admissible and accurate during incident response operations.
Sources:
- 0:07 Introduction to the topic of data integrity and forensically sound log extraction.
- 0:15 Explanation of why log quality matters in DFIR investigations.
- 0:21 Discussion on limitations and issues with collecting logs from web applications.
- 0:33 Methodology for scripting custom log collection tools to avoid web export failures.
- 0:45 Techniques f
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Incident Response. Commonly maps to: Security Operations, Security Assessment and Testing. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Thank you, Phil. And uh thank you everyone for coming to my talk, ensuring data integrity and incident response tools and techniques for forensically sound log extraction. To go over a highle agenda for today, I'm going to start by talking about why log quality matters during DFIR investigations and dive into some of the limitations and potential issues that I've ran into when collecting logs directly from web applications. Then when web-based exports fail, I'll teach you how to script out your own log collection tool that can circumvent some of those limitations that I mentioned before. During this section, we'll do a walkthrough of how to do this using a documented API. And I'll talk uh I'll tell you about a time when I didn't have a documented API and I had to use some web app hacking t…