Safety Norms: Digital Forensics and Threat Intelligence

1Purpose, Scope, and Safety Principles

These norms guide people who acquire, preserve, examine, and report digital evidence, and people who collect, validate, enrich, and share threat intelligence. Typical activities include disk and memory imaging, log and network capture review, mobile device extraction, malware triage in isolated laboratories, open source research into threat actors, indicator of compromise sharing, and incident reporting. The people involved include examiners, analysts, system owners, legal and privacy staff, case managers, and external partners. The environments range from enterprise endpoints and cloud tenants to evidence storage rooms, analysis labs, and shared intelligence platforms.

The core principles are authorization before action, do no harm to live systems, preserve integrity, collect only what the case needs, and record every significant decision. Laws, standards, and manufacturer instructions are jurisdiction dependent, so verify current versions with competent authorities, legal counsel, and qualified professionals. This is educational guidance and does not replace formal training, approved procedures, supervision, or emergency services.

• Mandatory: no examination, collection, or testing begins without written authorization naming the systems, data sources, purpose, and time window.
• Mandatory: when legality or scope is in doubt, stop and escalate to the case owner before proceeding.

2Roles, Competence, and Accountability

The case owner, usually a manager or counsel-designated lead, approves scope and decides how findings will be used. The lead examiner plans technical work and signs off on methods. The evidence custodian controls storage, access logs, and transfers. Analysts perform triage, reverse engineering, and enrichment. System owners approve any work that touches production systems, and privacy or legal staff advise on personal data and disclosure. Lab administrators keep isolated analysis environments patched, segmented, and documented. One person may hold more than one role, but no one should approve their own work in contested matters.

Competence comes before access. Staff must be trained on the specific tools and procedures they use, and must be supervised until a lead examiner confirms competence in writing. Live memory capture, mobile extraction, and malware detonation are specialist activities. Unqualified staff must not attempt them on production systems or evidentiary material.

• Mandatory: assign a named case owner, lead examiner, and evidence custodian to every case before collection begins.
• Mandatory: restrict administrator and forensic tool access to people whose competence is recorded.
• Recommended: pair junior analysts with experienced reviewers for early cases and require peer review of conclusions that affect people or operations.

3Course-Specific Hazards and Risk Assessment

Hazards in this field are both digital and physical. Digital hazards include executing live malware on an analyst workstation, contaminating evidence through improper mounting or writing to originals, wiping volatile memory through an unplanned reboot, and disrupting production systems with heavy scans, aggressive collection, or account lockouts. Data hazards include exposing personal, health, financial, or trade secret information, leaking indicators that reveal ongoing investigations, and sharing intelligence with parties who should not receive it. Legal hazards include accessing devices or accounts without authority and retaining data beyond approved retention rules.

Physical hazards include lithium battery swelling or fire in phones, laptops, and portable drives, overheating in dense lab racks, electrical risks from bench power supplies, and strain from long workstation sessions. Intelligence work adds operational hazards, such as actively probing a third party's infrastructure, which may be unlawful and can harm innocent operators.

Rate each hazard by likelihood and impact as high, medium, or low. A high hazard needs a documented control before work starts. A medium hazard needs a named owner and a scheduled review point in the case file. Reassess whenever scope, tools, or environments change.

• High: executing unknown samples outside an isolated lab, or collecting from production systems without system owner approval.
• High: writing to original evidence or failing to verify hash values.
• Medium: reboot or shutdown that destroys volatile data, or scan load that degrades service availability.
• Medium: exposure of personal data beyond case need.
• Medium: lithium battery damage or overheating during storage and transport.
• Low: fatigue, repetitive strain, and screen glare during analysis sessions.

4Preventive Controls and Safe Work Practices

Malware and suspicious files must be analyzed only in an isolated, segmented laboratory. The lab must have no route to production networks, no stored production credentials, and no shared folders with corporate systems. Analysts must take snapshots before detonation so the environment can be restored. Direct connections to attacker infrastructure are prohibited. Analysts should work from captured artifacts and passive sources instead.

Live response requires discipline. Collect volatile data in the order defined in the playbook, use signed and reviewed tools with known behavior, and record every command with its output. Avoid restarting systems unless safety or the incident coordinator requires it. Where a system cannot be taken offline, schedule collection to limit business impact.

• Must: copy evidence using a verified read-only method, calculate hash values before and after each copy, and record the algorithm used.
• Must: work on verified copies, never on original media, unless the lead examiner documents an approved exception and its reason.
• Must: keep chain of custody current for every transfer, recording time, person, and purpose.
• Must: obtain system owner approval before live response on production systems, and test every command set in the lab first.
• Must: limit scan and collection rates to levels agreed with the system owner, and stop immediately if service degradation appears.
• Must not: probe, scan, or interact with third-party systems, or take hack back actions against suspected attackers.
• Must not: use harvested credentials outside the authorized scope.
• Recommended: maintain a tested tool list with validated versions for each case type.
• Recommended: use dedicated analyst accounts and separate administrative workstations.
• Recommended: review queries sent to external threat platforms with legal staff, since submissions may reveal an investigation.

5Equipment, Environment, Information, and Protective Safeguards

Protect people and equipment. Lithium battery devices should be stored in fire-resistant containers away from workstations and exits. Damaged or swollen batteries must be isolated, labeled, and handled under the local hazardous materials procedure. Analysis benches need adequate electrical capacity, labeled power distribution, and cooling matched to equipment heat loads. Workstations should place screens at eye level, support wrists, and schedule short breaks into long sessions. Food and drink are prohibited near evidence and bare drives.

Protect information. Case data must be encrypted at rest and in transit, and stored only on approved systems. Personal devices must not hold case material. Apply the minimum necessary principle: collect what the authorized question requires, and isolate or purge the rest under the retention rule. Intelligence should carry handling markings from a recognized sharing scheme where the organization has adopted one. Sharing with external parties requires approval.

• Must: store seized or spare lithium batteries in approved containers and log damaged units.
• Must: lock evidence storage and log every access with name, time, and purpose.
• Must: apply multi-factor authentication to case systems and threat intelligence platforms.
• Must: separate personal data from case reports where possible, and review redactions before release.
• Recommended: use secure deletion methods approved by local policy when media leaves the lab.

6Incident Reporting, Emergency Response, and Escalation

Report every near miss, not only harmful events. Examples include a sample executing on a host, an evidence drive connected to a live network, lab traffic reaching an unexpected destination, accidental data disclosure, a lost or stolen device, or an overheating battery. The reporter must contain first. Disconnect the affected lab segment or device from networks, stop the running process where it is safe to do so, and preserve its state for examination. Do not wipe, reinstall, or power off a system without the lead examiner's approval, unless an immediate safety hazard requires it.

After containment, the lead examiner records the timeline, scope, and affected systems, and decides whether to escalate to a broader incident response. Lessons learned are recorded within a defined review period and linked to corrective actions with named owners.

• Must: notify the case owner and incident coordinator within the window set by local procedure, by phone if needed, then in writing.
• Must: involve privacy or legal staff when personal data may have been exposed, since notification duties vary by jurisdiction.
• Must: contact law enforcement or regulators only through the authorized channel named in the case plan.
• Physical: for a lithium battery fire, evacuate, activate the alarm, and call local emergency services. Untrained staff must not attempt to fight the fire.
• Physical: for injuries, provide first aid only if trained, call emergency services, and do not move the injured person unless they face immediate danger.

7Records, Training, Inspection, and Review

Every case file must contain the authorization memo, scope statement, chain of custody, hash records, tool names and versions, command logs, analysis notes, evidence handling decisions, and sharing approvals. Intelligence records should note the source, collection method, reliability and confidence ratings, and conditions for retiring each indicator. Notes must separate observed facts from inferences, because misattribution can harm innocent people.

Training covers tool use, legal boundaries, evidence handling, and incident response. Refresh training when tools change and at intervals set by the organization. Competence sign-offs and training records are kept in each staff member's file.

• Must: keep an inventory of lab systems, tools, and approved versions.
• Recommended: run tabletop exercises that simulate a detonation near miss and an evidence room access audit.
• Recommended: inspect lab isolation, backup integrity, and evidence storage on a fixed schedule.

8Responsible Use, Monitoring, and Continuous Improvement

Use findings responsibly. Attribution statements must state confidence and limits. Do not publish raw personal data or unverified accusations. Intelligence should be shared to protect others, not to gain advantage or damage competitors. Research must not enable attacks, so do not release working exploit code or operational details beyond what authorized sharing permits.

Monitor controls through regular review. Track near misses, isolation failures, late chain-of-custody entries, overdue reviews, and tool validation gaps. Review this document and local procedures after significant incidents, tool changes, or legal updates. Verify laws, standards, and manufacturer instructions against current official sources, because they change and vary by jurisdiction.

• Must: retire stale indicators according to the agreed review rule.
• Recommended: hold a periodic governance review of metrics, open actions, and policy gaps.
• Recommended: collect feedback from examiners, analysts, and system owners, and record each improvement action with an owner.

Implementation checklist

• Confirm written authorization names systems, data, purpose, and time window before any collection or analysis.
• Verify roles and competence records before assigning technical tasks.
• Run malware only in an isolated, snapshotted laboratory with no production route.
• Work from verified copies and record hash values before and after each copy.
• Obtain system owner approval and test commands in the lab before live response.
• Keep chain of custody and command logs current for every transfer and action.
• Limit personal data to case needs and route disclosure questions to legal staff.
• Report every near miss to the case owner within the window set by local procedure.
• Store lithium battery items in approved containers and evacuate for any battery fire.
• Review controls, indicators, and this procedure after significant changes.