Forensic Readiness and Evidence Handling
Domain 2 - Forensic Readiness and Evidence Handling
This domain tests preparation before an incident and the physical and logical handling that keeps evidence usable: policies, roles, seizure, packaging, transport, storage, and chain of custody. Questions often present a scenario and ask what breaks defensibility.
Core rules
- Forensic readiness means an organization can collect and preserve evidence before an incident, with defined authority, retention, logging, and trained responders.
- Evidence handling begins at seizure: photograph the scene, record make/model/serial, location, condition, power state, and who handled the item.
- Package anti-static where appropriate, label, seal, and sign across the seal; transport in controlled conditions; store in a secure, access-controlled, environmentally suitable evidence locker.
- Chain of custody records every transfer: from whom, to whom, date/time, purpose, signature. Gaps or unsigned entries weaken authentication.
- ACPO and ISO/IEC 27037 emphasize minimal handling, documented methods, and competence. Legal hold suspends routine deletion when litigation is reasonably anticipated.
- Hash the item or image at intake and verify at each critical transfer where feasible; record the tool and version.
Worked example
An employee is terminated and a company laptop is seized. The responder photographs the laptop and power state, records serial and asset tag, does not log in, places it in an evidence bag, seals and signs, and completes a custody form. At the lab, the examiner verifies seals, images the disk with a write blocker, hashes source and image, and records the hash in the case file. Reasoning: the unbroken record links the courtroom exhibit to the seized device; the hash links the image to the device; avoiding login prevents altering user artifacts.
Traps
Signing a custody form days later; transporting evidence in a personal bag; powering on to check it; failing to record serial numbers; mixing evidence from two devices; breaking a seal without documenting it; treating a hash as a substitute for custody.