Chain of Custody Under Time Pressure
An investigator is examining a suspected policy violation on a shared workstation. At 14:00 she photographs the screen showing an open document, then at 14:10 creates a forensic image of the drive. At 14:30 the workstation's owner returns, demands his laptop back, and the department manager instructs her to 'hand it over, we need it for a meeting at 15:00.' The investigator has the image on an external drive but has not yet verified its hash, has not documented the imaging tool or version, and the original machine will leave her custody. She has 30 minutes. She also learns the owner's account was shared with two colleagues, so any activity on it cannot be attributed to one person.
1. Identify the chain-of-custody and evidentiary weaknesses in this sequence and rank them by how much they threaten the case.
Read the worked answer
Ranked by severity:
- Unverified hash (most serious). Until the image is hashed and the hash compared to a re-computation, there is no proof the image faithfully represents the drive. If the hash is computed later and matches nothing, or if the drive is altered, the image's integrity is unprovable. This is fixable in minutes and must be done before anything else.
- Undocumented tool and version. Without recording what produced the image, the defense cannot assess reliability and the investigator cannot reproduce the result. Also fixable quickly.
- Loss of the original to custody. Handing the machine back breaks the documented custody chain from seizure to return. Mitigation: record the transfer formally - who took it, when, condition, and that it is being returned to operational use, with the image retained as the working copy.
- Shared account (attribution gap). This is not a custody flaw but it caps what the evidence can prove. Activity on the account cannot be tied to the owner; the case may need corroborating evidence (physical access logs, badge records, camera, witness statements).
The 14:00 photo is weak evidence of content (a screen photo is easily staged or altered and captures only what was displayed), but it is useful as a timeline anchor.
2. Given 30 minutes and an order to surrender the machine, what should the investigator do, in order?
Read the worked answer
Sequence by irreversibility - do the things that become impossible once the machine leaves first:
- Hash the image now and record the algorithm and both values. Re-hash to confirm reproducibility. This takes minutes and cannot be done after surrender.
- Document the tool, version, and settings used for imaging, plus the write-blocker if one was used.
- Write a custody transfer entry: time, the manager's instruction, the person receiving the machine, its condition, and a statement that the image is retained as the working copy. Get the manager to acknowledge if possible.
- Capture volatile context if still available (logged-in sessions, running processes) - but only if it does not delay steps 1-3; volatile data is lower priority than image integrity here.
- Notify the appropriate authority (compliance/legal/HR) that the original is leaving custody, in writing, same day.
What she should not do is refuse the manager outright without escalation - that is a policy dispute, not an evidence-preservation action, and the image plus documentation preserves the evidence regardless. The professional obligation is to preserve and document, and to make the custody break visible rather than silent.