CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 312: From Kimwolf Threats To Chain Of Custody: What Security Leaders Must Know (Domain 7.1)

·38 min·5 clips

Sean Gerber welcomes listeners back to CISSP Cyber Training and sets the tone for a study session built around Domain 7.1. He says the goal is to help people pass the CISSP exam and build out their cybersecurity knowledge. He starts with a cybersecurity leadership article tied to the CISSP exam and then uses that as a bridge into the lesson material. The discussion stays focused on the practical side of evidence handling instead of treating it like memorization alone. He talks through whether the right tools and outside help are available if evidence media is damaged. He gives the example of hard disk platters and whether a third party can recover data from physical media that has been hit or otherwise compromised. He notes that there are investigative teams, including clean-room capabilities, that can take a device apart and look for recoverable information. He also makes it clear that recovery is not guaranteed. He ties that to the cost of the work, saying that specialized recovery can run into the 10 or 15 thousand dollar range. The point is not to chase every possible recovery path blindly, but to weigh whether the effort is worth it. From there he turns to memory analysis. He explains that this means collecting the contents of memory with a trusted tool and moving that data to another device. He emphasizes that the tool should be one you have defined and can rely on for the job. That matters because the collection itself becomes part of the evidence. He says the dump will contain all the contents collected in memory, which may be a lot or a little depending on the situation. He also points out that after dumping the information, you should compute a hash for authenticity. That hashing step helps prove the evidence has not been altered. The whole process is presented as a practical workflow, not just a line item on an exam outline. Sean keeps the tone conversational and direct, with repeated reminders that make the material easier to carry into the field. He speaks as someone who wants the listener to understand why these controls matter when the stakes are real. The episode keeps circling back to investigation discipline and the value of doing things in a defensible way. That includes knowing when specialized recovery is available, when it may not pay off, and how to preserve memory evidence properly. He frames the topic for people who are trying to get through the CISSP, but the advice also lands for working security teams. The throughline is simple: know the process, protect the evidence, and be able to explain what you did. By the end, the episode connects technical handling to professional judgment. It is about investigations as a security and exam topic, not just a test subject.

As heard by us

A practical CISSP take on evidence handling, chain of custody, and investigation basics.

CISSP Domain 7.1 is treated here as practical exam material, but it reads just as clearly as a field guide for investigations. It walks through chain of custody, evidence handling, disk platter recovery, and memory analysis, then brings those pieces back to hashing collected…

Read the full review in PlayNext →

Why you'd press play

You want a clean, practical walk-through of CISSP Domain 7.1 investigation basics.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program