Digital Evidence Handling and Chain of Custody
What this domain tests
This domain tests whether you can show continuous, documented control of an item from seizure to courtroom, and whether you can justify every change in its state.
Core rules and concepts
- Chain-of-custody record. Each entry should carry an exhibit number, description (make, model, serial, IMEI), date and time, location, collecting person, purpose of transfer, receiving signature, and the condition of seals. Gaps are the defence's favourite target.
- Integrity versus authenticity. Integrity is demonstrated by hashing at acquisition and re-verifying at each handoff; authenticity is the legal conclusion that the item is what it claims to be.
- Working copies only. Analyse verified duplicates; keep the original sealed in appropriate storage. Hash before and after any operation that might change state.
- Order of volatility. Capture the most perishable state first, following RFC 3227 reasoning: registers and cache, then RAM, then network state, then disk, then archival media.
- Packaging. Anti-static bags for drives and boards, Faraday bags for radios, temperature and humidity control, and no magnetic fields. Photograph the scene and the item before altering anything.
- Documenting unavoidable change. Booting a device, plugging in a write blocker, or removing a battery changes state; record why, when, and with what effect.
Worked example
A running laptop is seized at a desk. Two options appear: pull the power cord, or issue a graceful shutdown. A graceful shutdown writes to disk, updates logs, and destroys RAM contents, so it is the wrong choice for a case turning on running processes or encryption keys. Pulling the cord preserves disk state but loses memory. The defensible sequence is to photograph the screen, capture RAM with a validated tool, note the tool version and output hash, then remove power. Each step goes in the custody record with a reason.
Traps that cost marks
- Re-hashing an exhibit after mounting it read-write, producing an unexplained mismatch.
- Leaving a handoff unsigned because the same examiner handled the item throughout.
- Using the original for analysis because the copy was inconvenient.
- Failing to record that a device was powered on, rebooted, or connected to a network.
- Storing a mobile phone without radio isolation and later being unable to explain a remote wipe.