Deliverables & chain of custody #

Standard deliverable set

• Executive Summary (1-pager): what happened, scope, business impact, status, top recommendations. Written for board/C-suite.
• Factual Findings Report (privileged): timeline, indicators, affected systems/accounts, TTPs by ATT&CK, data exposure assessment, remediation taken, residual risk.
• Technical Appendix: artifacts, queries, host triage summaries.
• IOC package: STIX 2.1 bundle and/or MISP export; hashes, IPs, domains, user-agents, mail subjects, YARA, Sigma, EDR hunting queries (CQL, KQL).
• Containment / eradication / recovery plan: step-by-step playbook adapted to client environment.
• Lessons learned / after-action: control gaps, detection gaps, process gaps, prioritized remediation roadmap with owners.
• Rules of Engagement doc (produced early, not at end).

Chain of custody specifics

• Disk imaging - FTK Imager or Guymager → .E01 (EnCase evidence file) with MD5 + SHA1 (and SHA256) hashes computed at creation and verified on each handoff. Hardware write blocker (Tableau) for physical acquisition.
• Memory - raw .mem or .lime; hash immediately.
• Cloud - AWS: cross-account snapshot share → copy to IR account with KMS re-encryption; document ARNs, snapshot IDs, timestamps, performer. M365: Purview eDiscovery Premium with legal hold + export (PST/MSG + metadata preservation).
• Evidence log - ID, source, acquisition time, acquirer, method, hashes, custody transfers (who/when/why). Signed.
• Analyst notes - contemporaneous, timestamped. Avoid speculation in written notes; mark hypotheses as such.
• Secure storage - encrypted, access-logged, retention aligned with engagement (often indefinite or until litigation closes).