Evidence Preservation and Chain of Custody

Introduction

Digital evidence is information of potential investigative or legal value that is stored, processed, or transmitted in digital form. It may include files, databases, photographs, browser records, emails, system logs, cloud records, mobile-device content, network traffic, metadata, and records held by service providers. Unlike many physical objects, digital evidence can be copied perfectly, altered without obvious physical signs, encrypted, remotely deleted, or changed automatically by normal system operation.

Evidence preservation is therefore not simply the act of taking possession of a device. It is a controlled process that protects the evidential value of information from the moment it is identified until it is presented, returned, destroyed, or otherwise disposed of. Chain of custody is the documented history of that control. Together, preservation and chain-of-custody procedures support authenticity, integrity, reliability, continuity, and admissibility.

The precise legal rules differ among jurisdictions. Investigators must therefore follow applicable legislation, court orders, organisational policy, and professional standards. Commonly relevant sources include rules of evidence, search-and-seizure law, privacy and data-protection legislation, electronic-transactions law, records-retention requirements, and sector-specific regulation.

Learning objectives

By the end of this chapter, students should be able to:

• distinguish digital evidence from digital information and physical evidence;
• explain the principles of integrity, authenticity, continuity, reliability, and reproducibility;
• plan and perform lawful seizure and initial documentation;
• select appropriate procedures for live systems, powered-off systems, mobile devices, cloud services, and network evidence;
• package, transport, store, and access evidence without contamination or alteration;
• use cryptographic hashing appropriately and explain its limitations;
• construct and audit a chain-of-custody record;
• identify risks involving time, encryption, volatile data, third parties, and artificial intelligence; and
• evaluate preservation decisions in a professional case scenario.

1. The evidential lifecycle

A useful model treats evidence handling as a lifecycle rather than a single event:

1. Recognition – identify potentially relevant devices, accounts, records, and locations.
2. Authority and planning – establish legal authority, scope, roles, safety requirements, and technical strategy.
3. Documentation – record the scene, system state, identities, times, and decisions.
4. Collection or seizure – acquire or take control of evidence using the least intrusive reliable method.
5. Preservation – prevent alteration, loss, contamination, unauthorised access, and environmental damage.
6. Examination and analysis – work from verified forensic copies where possible.
7. Reporting and presentation – explain methods, results, limitations, and continuity.
8. Retention and disposition – retain, return, transfer, or securely destroy material according to law and policy.

The lifecycle is iterative. For example, analysis may reveal that a cloud account or additional device must be preserved. Such a decision must be recorded rather than silently expanding the original scope.

Core evidential properties

• Integrity: the evidence has not been altered in an unauthorised or unexplained manner.
• Authenticity: the item is what the investigator claims it to be and is connected to its source.
• Continuity: the documented history shows who controlled the evidence, when, where, why, and how.
• Reliability: the collection and examination methods were dependable and appropriately applied.
• Reproducibility: another competent examiner can understand and, where feasible, repeat the process.
• Provenance: the origin, ownership, creation, and transfer history of the evidence are known.

No single property proves admissibility. A hash value can support integrity, but it does not prove lawful acquisition, authorship, or absence of earlier manipulation.

2. Lawful seizure and scope

A technically perfect acquisition may still be unusable if it was obtained unlawfully. Before collection, the investigator should identify the legal basis, such as a warrant, court order, consent, statutory power, contractual authority, incident-response mandate, or organisational policy. The authority should be checked for:

• the person, premises, account, device, or service covered;
• permitted categories of data;
• time period and geographical limits;
• authority to search, copy, decrypt, or seize;
• treatment of privileged, confidential, or personal data;
• restrictions on third-party or unrelated material; and
• reporting, retention, and return requirements.

The principle of scope minimisation requires collecting no more information than reasonably necessary. This is especially important for cloud accounts, employee devices, medical records, communications, and data belonging to uninvolved persons. When full-device acquisition is necessary, access to unrelated information should be controlled and documented.

Consent must be informed, voluntary, and given by a person with appropriate authority. Investigators should not assume that possession of a device proves ownership or authority to search its contents. In corporate investigations, employment policies and an incident-response plan may provide authority, but local law may still restrict monitoring or disclosure.

Initial risk assessment

At the scene, assess safety, legal scope, volatile evidence, encryption, remote access, and the risk of automatic alteration. Do not immediately open files, browse directories, or connect unknown media to a live system. Record who is present and prevent unnecessary interaction with devices.

A practical principle is: observe first, intervene second, document continuously. If a decision must be made quickly—for example, whether to disconnect a running computer—record the options considered, the expected evidential consequences, and the reason for the decision.

3. Documentation at the scene

Documentation creates the bridge between the physical object and the later forensic image. It should be contemporaneous, factual, legible, and attributable. A scene record commonly includes:

• case identifier and evidence-item identifier;
• date, location, and legal authority;
• names, roles, organisations, and contact details of participants;
• device make, model, serial number, asset tag, and visible condition;
• power state, screen content, connected cables, peripherals, and network links;
• photographs or video before movement;
• environmental conditions and physical security;
• actions taken, by whom, at what time, and for what reason;
• items left in place and the reason for leaving them; and
• unusual observations, uncertainties, and deviations from standard procedure.

Photographs should show the overall scene, the device in context, identifying labels, connections, and relevant screen displays. A photograph is not a substitute for notes: it may not reveal the exact sequence of actions or the identity of the person operating the device.

A contemporaneous note should distinguish observation from interpretation. “Screen displayed a login prompt” is an observation; “the user had logged out” is an inference unless supported by additional evidence.

4. Collection strategies by evidence type

Powered-off computers

If a computer is already powered off, it should normally remain off. Starting it can alter timestamps, logs, temporary files, encryption state, and other artefacts. Photograph the condition, label the equipment, disconnect or secure accessories as appropriate, and acquire storage media using a validated write-blocking process.

Running computers

A live system may contain volatile evidence, including memory contents, active network connections, running processes, encryption keys, unsaved documents, and logged-in sessions. Shutting it down can destroy these data; interacting with it can also alter them. Live response is therefore a risk-based decision requiring trained personnel.

A live-collection plan may include recording the screen, system clock, logged-in users, network state, and connected devices; collecting memory; documenting commands and tools; and then isolating or shutting down the system according to the case strategy. Every live action should be justified because tools and commands modify system state. If full-disk encryption is active, preserving keys or maintaining power may be crucial, but this must be balanced against remote tampering and safety risks.

Mobile devices

Mobile devices may communicate with networks, receive remote-wipe commands, change data through synchronisation, or lose data when batteries discharge. Place the device in a controlled state consistent with law and procedure. Network isolation may be achieved by approved methods such as airplane mode, shielded containers, or controlled removal of communication interfaces, but each method has limitations. A shielded bag can prevent communication but may also interfere with some legitimate acquisition processes and must be tested for effectiveness.

Do not casually unlock, browse, or enter passwords. Record the device state, displayed time, battery level, SIM or eSIM information, and visible notifications. Accessories, paired devices, backup accounts, and mobile-network records may also be relevant.

Network and cloud evidence

Network evidence is often transient. Logs may rotate, addresses may be reassigned, and cloud data may change through synchronisation or provider retention policies. Preservation requests should be sent promptly to service providers, identifying the account, relevant time range, data categories, and legal authority. A preservation request does not necessarily provide access; acquisition may require a separate legal process.

Cloud evidence requires attention to tenant separation, provider-generated metadata, jurisdiction, time zones, API limitations, audit logs, and the identity of the account holder. Record the provider, account identifier, collection method, query parameters, export format, and any provider certificate or attestation. A downloaded cloud file is not automatically equivalent to the original provider-side record.

5. Forensic acquisition and write protection

The preferred method is to create a forensic image or other defensible acquisition while preserving the original source. A write blocker prevents forensic equipment from sending write commands to storage media. Hardware and software write blockers should be validated for the specific interface and documented.

An acquisition record should identify the source, destination, tool and version, operator, start and end times, settings, errors, unreadable sectors, and verification results. A bit-stream image attempts to capture allocated and unallocated storage, subject to the capabilities and limitations of the method. Logical acquisition collects selected files or records and may be appropriate for cloud, mobile, or large enterprise systems, but it provides a narrower representation.

The original should be sealed and preserved. Examinations should normally occur on a verified working copy. If the original must be accessed, the reason, method, and effect must be documented.

6. Hashing and integrity verification

A cryptographic hash function maps data of arbitrary length to a fixed-length digest. For data D and hash function H, the digest is:

Here, D is the exact byte sequence and h is the resulting digest. The same input, processed by the same correctly implemented function, should produce the same digest. A suitable modern hash function is designed to make it computationally impractical to find a different input with the same digest, although hash functions do not prove who created the data or whether the original data was lawful.

Hash values can be calculated for a source, forensic image, exported file, or working copy. If the source image and its verified copy produce the same digest, this supports a claim that the copies are identical at the byte level. Hashing a file after opening it in an application may be problematic because the application or operating system might change metadata or content.

Investigators should record the algorithm, implementation or tool version, input definition, digest, date and time, and any errors. Older algorithms may be retained for compatibility or comparison, but a modern collision-resistant algorithm should normally be included according to organisational policy. Hashes are not encryption: they are not intended to be reversed to recover the original data.

Limitations of hashing

Hashing does not detect alteration that occurred before the first trusted hash was calculated. It does not establish authorship, intent, context, or meaning. Two identical files may have different filesystem metadata, while two files with similar content may have completely different hashes. Hash verification must therefore be combined with acquisition records, write protection, provenance, access controls, and examination notes.

7. Time synchronisation and temporal interpretation

Digital investigations depend heavily on time. Relevant timestamps may include creation, modification, access, transmission, log receipt, database insertion, and device clock time. These are not necessarily the same event. A timestamp may be stored in local time, UTC, an offset, or an application-specific format.

At collection, record the device clock, investigator reference time, time zone, daylight-saving status, and any observed offset. A reliable reference may be obtained from an approved time source, but the source and observation method must be documented. If a device clock is fast by Δt relative to the reference, a displayed event time can be compared with reference time only after accounting for that offset. The adjustment is not evidence that the event itself occurred at the adjusted time; it is an aid to interpretation.

A timeline should preserve original timestamps and show any normalisation separately. For example, retain “2025-04-03 14:00:00 UTC+02:00” and, if necessary, derive “12:00:00 UTC” as a converted representation. Avoid silently overwriting original values. Clock drift, network delay, queued messages, virtualisation, and log aggregation can all affect temporal conclusions.

8. Packaging, transport, storage, and access control

Packaging must protect both the physical item and its information. Use tamper-evident seals, evidence labels, anti-static materials where appropriate, and containers suited to the device. Avoid heat, moisture, magnetic exposure where relevant, crushing, and uncontrolled temperature. Batteries and damaged equipment may create safety hazards and should be handled under specialist procedures.

Each package should display a unique identifier, description, collector, date and time, seal number, and handling warnings. A seal is not proof that contents are authentic; it is a control that reveals possible opening or replacement. Broken seals must be recorded, explained, replaced, and witnessed according to policy.

During transport, maintain a documented transfer and protect the item from unauthorised access. Storage should use restricted access, environmental controls, surveillance where appropriate, and reliable inventory records. Digital evidence should be stored on controlled media with access logging, backups, malware protection designed not to alter evidence, and documented retention periods.

9. Chain of custody as an auditable control

A chain-of-custody record answers five questions for every significant event:

1. What item was controlled?
2. Who controlled it?
3. When did control begin and end?
4. Where was it kept or transferred?
5. Why and how was the action performed?

A compact transfer entry might contain:

Electronic systems can improve legibility, access control, and auditability, but they must themselves be secured. A digital register should use authenticated accounts, role-based permissions, audit logs, reliable clocks, backups, and controls against deletion or unauthorised editing. A blockchain is not a substitute for correct collection, trustworthy identities, or lawful authority; an immutable record of an incorrect entry remains incorrect.

The chain must include transfers to examiners, prosecutors, laboratories, translators, expert witnesses, courts, and storage facilities. Internal movement within a laboratory should be recorded when it changes responsibility or location. Unexplained gaps, inconsistent times, duplicate identifiers, or unsigned transfers are significant weaknesses and should be escalated rather than concealed.

10. Contamination, alteration, and quality assurance

Contamination can be physical, logical, procedural, or interpretive. Examples include malware transfer from a suspect device, changing access times by opening files, mixing exhibits, using unvalidated tools, copying the wrong account, or allowing investigative assumptions to influence notes.

Controls include:

• use of clean, dedicated examination environments;
• validated tools and documented versions;
• write blockers and read-only working practices;
• separation of original evidence from working copies;
• independent verification of hashes and acquisition logs;
• peer review of significant findings;
• least-privilege access and dual control for sensitive actions;
• contemporaneous notes and immutable audit records; and
• clear separation between fact, interpretation, and hypothesis.

Quality assurance should test whether procedures work under realistic conditions. Validation should address supported file systems, mobile versions, encryption, damaged media, time zones, and error handling. A tool that succeeds in one environment may silently omit data in another.

11. Ethics, privacy, and governance

Forensic authority carries a duty of care. Investigators should collect proportionately, protect confidential and privileged material, minimise exposure of personal data, and disclose material limitations. They must not manufacture certainty by presenting an inference as a fact or omit inconvenient results.

Privacy principles commonly require purpose limitation, data minimisation, security, retention control, transparency, and accountability. Cross-border cloud investigations may involve conflicting laws and transfer restrictions. Organisations should establish policies for legal review, provider requests, breach response, retention, secure destruction, and access to employee or customer data.

Artificial intelligence may assist with triage, clustering, translation, anomaly detection, and prioritisation. However, AI-generated classifications are not self-authenticating evidence. Investigators must preserve the underlying data, model or service information where relevant, prompts or settings, output versions, confidence limitations, and human verification. AI systems can misclassify images, hallucinate explanations, reproduce bias, or expose confidential evidence to an external provider. The final report should identify where automation influenced selection or interpretation.

12. Applied case: suspected insider disclosure

The following is an illustrative case, not a report of an actual incident.

Background

A financial-services organisation suspects that an employee copied customer records to a personal cloud account before resignation. The employee’s laptop is encrypted, powered on, and connected to the corporate network. Relevant data may also exist in email, endpoint logs, cloud storage, and a removable drive.

Problem

Immediate shutdown may prevent remote access but could lose encryption keys and volatile data. Continuing operation could permit deletion or synchronisation. The organisation must also avoid collecting unrelated customer and personal information beyond the authorised scope.

Analysis and approach

The response leader confirms the internal authority, involves legal and privacy officers, and defines a time window and data categories. A second examiner witnesses the initial actions. They photograph the laptop, screen, cable connections, asset tag, displayed clock, and network state. They record the reference time and calculate the observed clock offset without overwriting the original time.

A trained live-response examiner documents logged-in sessions, active connections, running processes, and memory acquisition using a validated tool. The network team preserves relevant endpoint and cloud audit logs, while legal personnel send preservation requests to the provider. The laptop is then isolated using the approved corporate procedure and acquired with a validated write blocker. The source and image are hashed with a documented modern algorithm; the image is verified before analysis.

The removable drive is separately labelled, photographed, sealed, and imaged. Each transfer is entered in the custody register. Examiners work only from verified copies, retain original timestamps, and produce a timeline that distinguishes device time, UTC conversion, email transmission time, and provider log time.

Outcome

The evidence shows that a compressed archive was created during the authorised time window and uploaded through a corporate endpoint. The cloud provider’s records corroborate the account activity. The report carefully states that the evidence supports copying and transmission from the employee’s assigned device; it does not by itself prove the employee’s personal intent or establish who physically operated the keyboard at every moment.

Learning points

The case demonstrates why lawful scope, live-response planning, time documentation, provider preservation, hashing, independent verification, and cautious interpretation must operate together. No individual control would have been sufficient on its own.

Challenges and limitations

Evidence preservation is affected by encryption, damaged media, proprietary formats, virtual machines, ephemeral cloud instances, remote wiping, rotating logs, shared accounts, unreliable clocks, incomplete provider responses, and limited laboratory capacity. Full acquisition may be impractical for large repositories, while selective acquisition risks omission. A sound strategy explains the trade-off, records search criteria, preserves relevant metadata, and states what was not collected.

Admissibility is ultimately determined by the applicable legal system and decision-maker. Technical compliance strengthens a case but cannot guarantee admission. Conversely, a procedural error does not always make evidence unusable; its effect depends on law, materiality, prejudice, and the quality of compensating controls. Investigators should therefore identify and disclose deviations rather than assuming that silence protects the case.

Best-practice checklist

Before seizure: confirm authority, scope, safety, roles, and volatility. At the scene: photograph, observe, label, isolate appropriately, and record every action. During acquisition: use validated tools, write protection, verified copies, and hashes. During handling: use sealed packaging, controlled storage, and complete transfer records. During analysis: preserve originals, work from copies, retain original timestamps, and separate facts from inferences. Before reporting: conduct peer review, disclose limitations, verify continuity, and confirm that retention and privacy obligations have been met.

Chapter Summary

Evidence preservation is a lifecycle of lawful recognition, planning, documentation, collection, protection, examination, reporting, and disposition. Digital evidence is unusually vulnerable to alteration, remote deletion, automatic system activity, encryption, and misleading timestamps. Lawful authority and scope must be established before technical collection.

Reliable practice combines scene documentation, risk-based live response, write-protected acquisition, forensic imaging, cryptographic hashing, time synchronisation, secure packaging, controlled storage, and a complete chain of custody. Hashing supports byte-level integrity but does not prove authenticity, authorship, legality, or context. Time analysis requires preservation of original values and explicit treatment of time zones and clock offsets. Chain-of-custody records must identify each item, custodian, time, location, purpose, condition, and transfer.

Professional practice also requires privacy protection, proportionality, validation, peer review, transparent limitations, and careful governance of cloud services and AI-assisted tools. The strongest forensic conclusion is not the most certain-sounding one; it is the one whose authority, method, provenance, integrity, and limitations can be independently evaluated.

Key Terms

Authenticity: The quality of being what the evidence is claimed to be and being connected to its source.

Chain of custody: The documented history of possession, control, transfer, storage, and handling of evidence.

Cryptographic hash: A fixed-length digest generated from data by a hash function.

Digital evidence: Information of potential evidential value stored or transmitted in digital form.

Evidence integrity: Confidence that evidence has not been altered without authorisation or explanation.

Forensic image: A representation of storage media acquired for forensic examination.

Hash verification: Comparison of calculated digests to assess whether data remains byte-for-byte consistent.

Live response: Collection from a running system, including potentially volatile information.

Metadata: Data describing other data, such as timestamps, authorship fields, or file attributes.

Original evidence: The source item or data from which an evidential copy is made.

Provenance: Information about origin, ownership, creation, and history.

Scope minimisation: Limiting collection and examination to information relevant and authorised for the matter.

Tamper-evident seal: A seal designed to reveal opening, removal, or replacement.

Time synchronisation: Comparison or alignment of device time with a trusted reference time.

Volatile data: Information that may disappear or change when power or system state changes.

Write blocker: A hardware or software control intended to prevent writes to source media.

Working copy: A verified duplicate used for examination instead of the preserved original.

Review Questions

Short Answer Questions

1. Define chain of custody and identify the five questions a custody record should answer.
2. Why should a powered-off computer normally remain powered off?
3. What does a cryptographic hash support, and what does it not prove?
4. Identify four items that should be recorded when documenting a digital device at a scene.
5. Why must original timestamps be preserved when constructing a forensic timeline?

Long Answer Questions

1. Explain the complete digital-evidence lifecycle and show how preservation supports admissibility and reliability.
2. Compare the risks and benefits of collecting evidence from a running computer with those of collecting it after shutdown.
3. Describe a defensible procedure for packaging, transporting, storing, and transferring a seized storage device.
4. Explain how privacy, proportionality, legal authority, and scope affect forensic collection in a cloud environment.
5. Discuss the limitations of hashing and explain why hashing must be combined with other integrity controls.

Analytical / Application Questions

1. A powered-on encrypted laptop is connected to an unknown wireless network and displays an open document. Develop a documented decision strategy addressing volatile data, remote access, encryption, legal scope, and contamination risk.
2. A laboratory discovers that an evidence seal was broken during an undocumented movement between rooms. Analyse the consequences and propose corrective and reporting actions.
3. An AI tool identifies files as “confidential customer exports,” but its classification is not reproducible. Explain how the investigator should preserve, validate, document, and report the AI-assisted result.

Multiple Choice Questions with Answers

Question 1

Which property describes the documented history of possession and transfer of evidence?

A. Availability

B. Continuity

C. Compression

D. Redundancy

Correct Answer: B. Continuity

Question 2

What is the primary purpose of a write blocker?

A. To encrypt the forensic image

B. To prevent writes to source media

C. To recover deleted passwords

D. To synchronise system clocks

Correct Answer: B. To prevent writes to source media

Question 3

A cryptographic hash is best described as:

A. A reversible encryption key

B. A fixed-length digest derived from data

C. A legal authorisation to search

D. A record of user intent

Correct Answer: B. A fixed-length digest derived from data

Question 4

Which action is generally appropriate when a computer is already powered off?

A. Start it and browse recent files

B. Install forensic software on it

C. Keep it off until controlled acquisition

D. Connect it to an open network

Correct Answer: C. Keep it off until controlled acquisition

Question 5

Which statement about hashing is correct?

A. It proves who created a file

B. It proves the search was lawful

C. It supports comparison of byte-level consistency

D. It automatically identifies the file’s meaning

Correct Answer: C. It supports comparison of byte-level consistency

Question 6

Why should an investigator retain the original timestamp as well as a converted UTC value?

A. To conceal clock errors

B. To preserve source information and make conversion transparent

C. To make all events appear simultaneous

D. To avoid documenting time zones

Correct Answer: B. To preserve source information and make conversion transparent

Question 7

Which item is most relevant to a chain-of-custody transfer entry?

A. The examiner’s personal opinion about guilt

B. The evidence identifier, custodians, time, purpose, and condition

C. The suspected motive without supporting data

D. An unrelated device serial number

Correct Answer: B. The evidence identifier, custodians, time, purpose, and condition

Question 8

What is a major risk of live response?

A. It can never collect volatile data

B. It may alter system state while collecting information

C. It eliminates the need for legal authority

D. It guarantees complete acquisition

Correct Answer: B. It may alter system state while collecting information

Question 9

A preservation request to a cloud provider primarily seeks to:

A. Automatically prove authorship

B. Prevent relevant provider-held data from being lost or routinely deleted

C. Replace the need for a warrant in every jurisdiction

D. Decrypt every user account

Correct Answer: B. Prevent relevant provider-held data from being lost or routinely deleted

Question 10

Which practice best supports reliable forensic conclusions?

A. Working directly on the only original and omitting errors

B. Using verified working copies, validated tools, and documented limitations

C. Relying solely on an AI classification

D. Changing original timestamps into local time

Correct Answer: B. Using verified working copies, validated tools, and documented limitations