Evidence Preservation and Chain of Custody

Introduction

Digital evidence is information of potential investigative or legal value that is stored or transmitted in digital form. It may exist on computers, mobile phones, removable media, cloud services, vehicles, network devices, application servers, or Internet-of-Things systems. Unlike many physical objects, digital evidence can be copied perfectly, altered rapidly, encrypted, remotely deleted, or changed merely by switching on a device. Consequently, the first task of a forensic examiner is not analysis but preservation.

Evidence preservation is the controlled process of securing a scene, identifying relevant sources, preventing alteration, collecting data, documenting actions, and maintaining evidence in a condition that permits reliable examination. The chain of custody is the chronological record showing who possessed evidence, when, why, how it was transferred, and what safeguards were applied. Together, preservation and chain-of-custody procedures support authenticity, integrity, reproducibility, and admissibility.

This chapter focuses on practical foundations appropriate to cyber-law and forensic work. It does not replace the law, an organisation’s policy, or the instructions of a competent authority. Legal requirements differ across jurisdictions, and investigators should obtain appropriate authority before searching or seizing data.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Secure a digital scene and identify risks of alteration or loss.
2. Explain the purposes and limitations of write protection.
3. Distinguish volatile from non-volatile evidence and select an appropriate acquisition order.
4. Calculate and interpret cryptographic hashes.
5. Package, label, transport, and store digital evidence safely.
6. Create and maintain a complete chain-of-custody and audit record.
7. Recognise legal, ethical, technical, and operational limitations in preservation.

1. The Preservation Problem

Digital evidence has three important characteristics. First, it is highly changeable. Operating systems update timestamps, applications create logs, and a device may connect to a network immediately after power is applied. Second, it is distributed. A laptop may contain local files while relevant authentication records, backups, and messages reside with several service providers. Third, it is dependent on context. A file without its metadata, time zone, source, and acquisition history may be difficult to interpret or authenticate.

The forensic objective is therefore not simply to obtain a file. It is to preserve sufficient information to answer:

• What was collected?
• From which source and location?
• By whom and under what authority?
• When was it collected, using which method and tool?
• Has it changed since collection?
• Can another competent examiner reproduce or evaluate the process?

A useful distinction is between original evidence, forensic image, working copy, and derived evidence. An original may be a seized storage device. A forensic image is an exact sector-level or logically defined representation acquired from it. A working copy is a duplicate used for examination. A derived item may be a report, extracted browser history, screenshot, or timeline generated from the source. Each stage must be traceable to the preceding stage.

2. Scene Security and Initial Decisions

2.1 Authority and scope

Before collection, confirm the legal and organisational authority: warrant, consent, statutory power, incident-response mandate, contractual authority, or emergency procedure. Read the scope carefully. Authority to seize a computer does not automatically authorise examination of every account or cloud repository associated with it. Record restrictions, time limits, privileged material, personal data, and conditions concerning notification or minimisation.

2.2 Physical and digital safety

The first responder should protect people before evidence. The area may contain electrical hazards, damaged batteries, hostile individuals, or active criminal infrastructure. Establish a perimeter, restrict access, and maintain an entry log. Photograph the scene before moving objects, recording device positions, cable connections, screen displays, indicator lights, and removable media.

Digital isolation must be deliberate rather than automatic. Disconnecting a device may prevent remote wiping but can also destroy volatile evidence or interrupt an encryption key held in memory. If a system is live, a trained responder should assess the risk of shutdown, remote access, encryption, and running processes. Do not casually browse files, click applications, or type commands: each action may modify evidence.

2.3 Triage questions

Initial triage should consider:

• Is the device powered on, asleep, locked, or powered off?
• Is full-disk encryption likely?
• Is there an active network or wireless connection?
• Could remote destruction or synchronisation occur?
• Is volatile evidence, such as memory or network state, important?
• Is the device a server, virtual machine, mobile device, or embedded system?
• Are there legal or safety reasons to stop collection?

There is no universal “pull the plug” rule. The appropriate action depends on the investigation, authority, system state, encryption, and trained judgment. Every decision and its rationale should be documented.

3. Volatile and Non-Volatile Evidence

Volatile evidence disappears or changes when power is removed or time passes. Examples include RAM contents, active network connections, logged-in sessions, running processes, clipboard contents, temporary keys, and some cloud access tokens. Non-volatile evidence persists without power, including data on storage media, printed records, and some device logs.

A typical live-response sequence may include documenting the display, recording date and time, capturing memory, collecting network and process information, and then acquiring storage. However, live tools alter the system and may introduce files or processes. The examiner should use validated tools, minimise interaction, record commands, preserve output, and explain limitations.

For a powered-off device, avoid turning it on merely to inspect it. Label it, photograph it, remove or isolate power according to procedure, and acquire the media using an approved forensic workstation. For mobile devices, network isolation must account for cellular, Wi-Fi, Bluetooth, and possible remote-management functions. A shielded container may reduce communications, but it should be tested because shielding is not always complete.

4. Write Protection and Acquisition

A write blocker is a hardware or software control intended to prevent writes to the evidence source while permitting reads. Hardware write blockers are generally preferred for physical media because they separate the forensic workstation from the source at the interface level. Software controls can be useful but require verification that the operating system and acquisition tool cannot write to the source.

Write protection does not make every process safe. It does not prevent alteration by malware, firmware, a failing device, a network service, or a person who bypasses the control. It also does not protect data after it has been copied. The examiner should record the make, model, serial number, firmware or software version, test status, and configuration of the blocker.

A forensic image may be a physical image of addressable sectors or a logical acquisition of selected files. A physical image can include deleted, slack, and unallocated space, whereas a logical acquisition may be faster but narrower. The method must match the legal scope and investigative question. If a device is damaged, a specialist may need to use a controlled recovery method; such intervention must be documented because it may change the source.

A sound acquisition record includes source identifiers, start and end times, examiner, tool and version, acquisition type, errors, bad sectors, destination media, and verification results. Acquisition logs should be retained with the case record.

5. Cryptographic Hashes and Integrity

A cryptographic hash function maps input data of arbitrary length to a fixed-length digest. For data D, the digest can be represented as:

Here, H is the selected hash algorithm, D is the exact byte sequence, and h is the resulting digest. The calculation has no physical unit. If the same bytes are supplied to the same algorithm, the expected digest is the same. A changed byte should produce a different digest with overwhelmingly high probability, although a hash is not proof of authorship, legality, or truthfulness.

For two data sets D₁ and D₂, an integrity comparison is:

In practice, equality supports the conclusion that the byte sequences are consistent with one another; it does not establish absolute identity in a mathematical sense because collision resistance is computational rather than perfect. If the digests differ, the data differ or the process was not identical.

Modern practice commonly uses SHA-256 or SHA-512, subject to policy and tool support. MD5 and SHA-1 have known collision weaknesses and should not be selected as the sole modern integrity mechanism. Older values may still be recorded for continuity, but a stronger algorithm should normally be added.

Worked example

An examiner acquires an image and obtains the SHA-256 digest 7a...91 (a shortened display used only for illustration). A second examiner copies the image and calculates 7a...91. The matching values support that the copy is byte-consistent with the acquired image under SHA-256. If the second value is 7a...92, the examiner must stop, preserve both files, check the acquisition log and storage media, and determine whether the difference arose from copying, compression, tool behaviour, or corruption. The examiner must not simply edit the image or overwrite the original.

Hashing should occur at appropriate stages: source or acquisition verification, image verification after transfer, working-copy verification, and exported-item verification. Record the algorithm, exact input, digest, tool, version, date, time zone, and operator. Hashing a report does not prove that the underlying evidence was authentic; it only protects the exact report bytes from unnoticed change.

6. Packaging, Labelling, Transport, and Storage

Packaging should protect evidence from physical damage, electromagnetic interference, moisture, heat, unauthorised access, and accidental activation. Use anti-static packaging where appropriate, rigid containers for fragile devices, and separate packaging for each item. Do not place wet or contaminated equipment in a sealed package until safety procedures address the hazard. Batteries and damaged lithium-ion devices require specialist handling.

Labels should be unique and durable. A label normally includes the case identifier, item number, brief description, source or location, collector, date and time, and any hazard or handling instruction. Avoid writing directly on original media unless an approved procedure permits it; use the packaging label instead.

A package seal should show whether it has been opened. If a seal is broken for examination, record the reason, date, person, new seal number, and condition of the contents. Evidence should be stored in an access-controlled, environmentally suitable location. Access should be limited to authorised personnel and logged. Digital repositories require authentication, permissions, encryption where appropriate, backups, integrity monitoring, and retention controls.

Transport should use a documented handover, secure container, and suitable environmental protection. Never leave evidence unattended in an unsecured vehicle. For cloud or remote evidence, preservation may involve a legal preservation request, provider export, API collection, or controlled administrative access. Record provider, account identifier, time zone, export format, scope, and any provider-generated metadata.

7. Chain of Custody and Audit Documentation

Chain of custody is a chronological accountability record. It begins when evidence is identified or received and continues through collection, packaging, transfer, storage, examination, copying, disclosure, return, or destruction. A complete record should allow an independent reviewer to reconstruct possession and handling without relying on memory.

A custody entry should contain:

The chain of custody is not merely a signature sheet. It must connect the physical item, acquired image, working copy, and report. For example, a report should identify the image used; the image should identify the source device; and the source should be linked to the scene record.

Electronic systems can improve auditability by assigning immutable event records, role-based access, timestamps, and alerts. Nevertheless, an automated log is not automatically reliable. Administrators must protect the system, synchronise clocks, retain audit records, and document corrections. Corrections should be made by an additional explanatory entry, never by silently deleting the original record.

8. Applied Case: Illustrative Ransomware Investigation

Background

A small manufacturer discovers that a file server has been encrypted and a ransom note has appeared. The organisation suspects that an employee account was compromised. This is an illustrative case, not a report of a real incident.

Problem

The server is still running, several users are connected, and automated backup software is active. Shutting it down may lose memory-resident evidence and interrupt business operations; leaving it connected may permit further encryption or remote wiping.

Analysis

The incident lead obtains organisational authority, isolates the server from external networks using a controlled change, and preserves relevant firewall and identity-provider logs. A trained responder photographs the console and records system time, connections, processes, logged-in users, and encryption status. Memory is captured using a documented tool, with hashes calculated immediately. The team then determines whether the server can be safely stopped and acquires its storage through a verified write-blocked process.

Approach and solution

Each physical item receives a unique identifier. The original server media is sealed and stored. A forensic image is written to controlled evidence storage, verified with SHA-256, and used to create a working copy. Investigators document every transfer and record the source of each extracted artefact. A separate preservation request is sent to the cloud identity provider for authentication logs within the authorised time range. The backup system is isolated and its logs preserved without altering backup content.

Outcome

The team can show which device and logs were collected, who handled them, how images were created, and that the working copy matched the acquired image at examination. The investigation later identifies a suspicious login and a scheduled task, but those conclusions are credible partly because the underlying evidence was preserved and traceable.

Learning points

Business continuity and evidence preservation must be coordinated. Network isolation should be targeted and documented. Volatile capture can be valuable but must be justified. Hashes support integrity, while chain-of-custody records support accountability. Neither substitutes for lawful authority, competent interpretation, or complete documentation.

9. Legal, Ethical, and Professional Issues

Preservation must respect privacy, privilege, data-protection law, employment rules, and proportionality. Collect only what is authorised and reasonably relevant. Segregate privileged or unrelated personal material, restrict access, and use approved review procedures. Investigators should not search beyond scope merely because a tool makes it technically possible.

Integrity records must be honest. An examiner should disclose failed acquisitions, missing logs, tool limitations, clock inaccuracies, damaged seals, and any interaction that may have changed data. Fabricating a complete-looking chain is more damaging than reporting an imperfect one. Professional conclusions should distinguish observation, inference, and speculation.

Courts and regulators may evaluate authenticity, reliability, relevance, continuity, and compliance with procedure. A matching hash helps demonstrate continuity of bytes, but admissibility is a legal determination. Expert evidence should explain methods in language that permits challenge and independent evaluation.

10. Challenges and Limitations

Important difficulties include full-disk encryption, proprietary formats, damaged media, cloud volatility, multi-tenant infrastructure, time-zone errors, clock drift, remote administration, anti-forensic activity, and incomplete provider records. Hashes cannot identify who created a file or prove that a device was not compromised before collection. Write blockers cannot solve every hardware or firmware problem. A chain-of-custody form cannot repair an unauthorised search.

Time is also a source of risk. Delayed preservation may allow log rotation, cloud expiration, automatic deletion, or remote wiping. Conversely, hurried collection can produce incomplete or contaminated evidence. Good practice balances urgency with a documented decision process.

11. Best-Practice Checklist

• Confirm authority, scope, and safety conditions.
• Restrict and log scene access.
• Photograph and document device state before interaction.
• Assess volatility, encryption, connectivity, and remote-destruction risk.
• Use trained personnel and validated tools.
• Employ tested write protection for physical media.
• Record device identifiers, tool versions, settings, times, and errors.
• Hash acquisitions and working copies using an approved algorithm.
• Keep originals protected; analyse verified copies.
• Package, seal, label, and store each item securely.
• Record every transfer, opening, resealing, access, and disposition.
• Preserve provider and cloud evidence promptly and lawfully.
• Disclose limitations and discrepancies.
• Review the complete record before reporting or presenting evidence.

Chapter Summary

Evidence preservation protects digital information from alteration, loss, contamination, and unauthorised access. Effective practice begins with lawful authority, safety, scene control, photography, and a documented assessment of device state and volatility. Live systems may contain valuable memory and network evidence, while powered-off systems should generally not be started without a justified plan.

Write blockers reduce the risk of writes during acquisition but require testing and documentation. Forensic images and working copies must be linked to their sources. Cryptographic hashes provide a reproducible integrity check for exact byte sequences; they do not prove authorship, legality, or meaning. Secure packaging, labelling, transport, storage, and access controls protect both physical and digital evidence.

A complete chain of custody records identity, possession, purpose, condition, location, method, and verification from collection through final disposition. Ethical and legally sound work requires proportionality, privacy protection, disclosure of limitations, and respect for the authorised scope. Preservation is therefore both a technical discipline and an accountability system.

Key Terms

Digital evidence: Information in digital form that may have investigative or legal value.

Evidence preservation: Measures taken to prevent loss, alteration, contamination, or unauthorised access.

Chain of custody: Chronological record of evidence possession, handling, transfer, and disposition.

Volatile evidence: Data that may disappear or change when power or time changes.

Non-volatile evidence: Data that normally persists without power.

Forensic image: A documented representation of digital storage acquired for examination.

Working copy: A verified duplicate used for forensic analysis.

Write blocker: A hardware or software control intended to prevent writes to source media.

Cryptographic hash: A fixed-length digest calculated from digital data.

SHA-256: A member of the Secure Hash Algorithm family producing a 256-bit digest.

Integrity: Confidence that data has not changed in an unauthorised or undetected manner.

Acquisition: The controlled process of collecting digital data.

Metadata: Data describing characteristics such as time, location, ownership, or format.

Logical acquisition: Collection of selected accessible files or objects.

Physical acquisition: Sector-level collection of addressable storage media.

Audit trail: Chronological record of system or evidence-related actions.

Evidence seal: A tamper-evident closure used to protect packaging.

Scope: The authorised limits of a search, collection, or examination.

Preservation request: Formal request to retain potentially relevant data.

Anti-forensics: Actions intended to conceal, destroy, or mislead forensic examination.

Review Questions

Short Answer Questions

1. Why should a powered-on computer not automatically be unplugged?
2. What is the purpose of a write blocker?
3. Define a cryptographic hash and state what a matching hash supports.
4. List four pieces of information that should appear in a chain-of-custody entry.
5. Why should forensic analysis normally be performed on a verified working copy?

Long Answer Questions

1. Explain a structured first-responder procedure for securing and documenting a digital scene.
2. Compare volatile and non-volatile evidence and discuss how their differences affect acquisition order.
3. Explain how hashing, imaging, and write protection work together to support evidence integrity.
4. Describe appropriate packaging, transport, storage, and access controls for digital evidence.
5. Discuss the legal and ethical importance of scope, proportionality, privacy, and disclosure of limitations.

Analytical / Application Questions

1. A live encrypted laptop is connected to a network and displays an open document. Develop and justify a preservation plan, including risks and documentation.
2. A copied forensic image has a different SHA-256 digest from the original. Analyse possible causes and specify the steps an examiner should take.
3. In a ransomware incident, compare the evidential and operational consequences of immediate shutdown, continued connection, and controlled network isolation. Recommend a course of action and justify it.

Multiple Choice Questions with Answers

Question 1

Which action best protects a forensic source disk from writes during acquisition?

A. Open files directly using the normal operating system

B. Use a tested hardware write blocker

C. Rename the files before copying them

D. Compress the source disk first

Correct Answer: B. Use a tested hardware write blocker

Question 2

Which item is normally volatile evidence?

A. A printed contract

B. A powered-off USB drive

C. RAM contents

D. A sealed forensic image

Correct Answer: C. RAM contents

Question 3

What does a matching SHA-256 digest primarily support?

A. That the data was created by a named person

B. That the compared byte sequences are consistent

C. That the search was legally authorised

D. That the interpretation is correct

Correct Answer: B. That the compared byte sequences are consistent

Question 4

Which information is essential in a chain-of-custody record?

A. The examiner’s preferred software colour scheme

B. The evidence transfer time and parties involved

C. The device’s retail price only

D. An unverified guess about the offender

Correct Answer: B. The evidence transfer time and parties involved

Question 5

Why is a live system potentially valuable to examine before shutdown?

A. It always contains more storage capacity

B. It may contain volatile data such as keys and network connections

C. It cannot be altered while powered on

D. It automatically creates a legally admissible report

Correct Answer: B. It may contain volatile data such as keys and network connections

Question 6

Which statement about cryptographic hashes is correct?

A. A hash proves who authored a file

B. A hash proves that a search was lawful

C. A hash can reveal unnoticed changes to compared data

D. A hash prevents all future modification

Correct Answer: C. A hash can reveal unnoticed changes to compared data

Question 7

What is the best routine practice for forensic analysis?

A. Analyse the original source whenever possible

B. Analyse a verified working copy

C. Edit the original to remove irrelevant files

D. Disable all acquisition logs

Correct Answer: B. Analyse a verified working copy

Question 8

What should an examiner do when a package seal is broken for examination?

A. Discard the old seal record

B. Open it without recording the reason

C. Record the reason, date, person, and new seal information

D. Return it without resealing

Correct Answer: C. Record the reason, date, person, and new seal information

Question 9

Which statement correctly distinguishes a physical from a logical acquisition?

A. A physical acquisition may include unallocated space; a logical acquisition is usually selected accessible data

B. A logical acquisition always includes every storage sector

C. A physical acquisition can collect only screenshots

D. There is no practical difference between them

Correct Answer: A. A physical acquisition may include unallocated space; a logical acquisition is usually selected accessible data

Question 10

What is the main purpose of a preservation request to a cloud provider?

A. To authorise any search of every customer account

B. To ask that potentially relevant provider-held data be retained

C. To replace all chain-of-custody documentation

D. To guarantee that the data is authentic

Correct Answer: B. To ask that potentially relevant provider-held data be retained