6. Evidence Identification, Acquisition and Preservation

Introduction and Context

Digital evidence is information of potential investigative value that exists in digital form or is represented through digital systems. It may be found in a laptop, mobile telephone, server, cloud service, industrial controller, network appliance, virtual machine, removable medium, or volatile memory. Unlike many physical objects, digital evidence can be altered without visible signs, duplicated exactly, distributed across jurisdictions, and destroyed through ordinary system activity. Evidence identification, acquisition, and preservation are therefore not merely technical tasks. They are disciplined processes that connect incident response, forensic science, information governance, and legal accountability.

The investigator must answer three related questions. What information may be relevant? How can it be collected without unreasonable alteration? How can its identity, integrity, provenance, and continuity be demonstrated later? A technically sophisticated extraction may still be unusable if its source is uncertain, its handling is undocumented, or the method cannot be explained and reproduced.

This chapter examines dead-box and live acquisition of disks, memory, logs, and remote systems. It also explains write blockers, forensic imaging, cryptographic hashing, order of volatility, evidence handling, and the professional decisions required when operational continuity conflicts with evidential preservation.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish potential, identified, acquired, and preserved digital evidence.

2. Select appropriate live or dead-box acquisition methods.

3. Apply the order-of-volatility principle to collection planning.

4. Explain the purposes and limitations of write blockers, forensic images, and cryptographic hashes.

5. Acquire volatile memory, disks, logs, and remote data in a defensible manner.

6. Maintain documentation, chain of custody, integrity, and repeatability.

7. Evaluate operational, legal, ethical, and technical risks in acquisition decisions.

8. Design an evidence-acquisition plan for a complex incident.

Evidence as a Forensic Object

Identification, acquisition, and preservation

Evidence identification is the process of locating information that may establish an event, action, state, relationship, or absence. At the beginning of an investigation, the examiner often deals with potential evidence: a powered-on workstation, a suspicious account, a network segment, or a cloud tenant. Identification converts this broad possibility into a reasoned selection of sources.

Acquisition is the controlled process of obtaining a representation of the source. A physical disk image, a memory capture, an exported audit log, and a provider-produced cloud record are all acquisitions, but they differ in scope and fidelity. Preservation is the set of measures used to protect the acquired material and its contextual information from alteration, loss, contamination, or ambiguity.

A useful distinction is between the original source, the forensic duplicate or image, the working copy, and derived outputs. The original source is the device, account, system, or service from which information is obtained. The forensic image is a bit-level or logically defined representation created for examination. A working copy is used for analysis so that the master acquisition remains protected. Derived outputs include timelines, recovered files, screenshots, parsed records, and investigative reports.

Characteristics of reliable digital evidence

Reliable evidence should have demonstrable authenticity, integrity, relevance, reliability, and provenance. Authenticity concerns whether the item is what it is claimed to be. Integrity concerns whether it has changed since acquisition. Relevance concerns its relationship to the investigative question. Reliability concerns the method, tool, system, and circumstances through which it was collected. Provenance records where the item came from, who handled it, and what happened to it.

Digital evidence is also contextual. A single timestamp or log entry rarely proves an entire event. Time zones, clock drift, daylight-saving changes, retention policies, account sharing, automated processes, and log forwarding can change interpretation. Consequently, acquisition should preserve not only content but also metadata about the source, configuration, time reference, access permissions, and collection method.

A Decision Model for Acquisition

Acquisition begins with a decision, not a tool. The investigator should define the investigative question, identify likely sources, assess volatility, determine authority, evaluate operational impact, and select the least intrusive method capable of answering the question.

The central choice is between live and dead-box acquisition. In dead-box acquisition, the system is powered down or isolated and storage is removed or accessed through a controlled forensic workstation. This approach reduces changes caused by the running operating system and is generally preferred when volatile information is not essential or when shutdown will not destroy material. In live acquisition, the system remains powered and evidence is collected while services and processes continue to operate. Live acquisition is necessary when memory, running processes, active network connections, encrypted volumes, or ephemeral cloud sessions are important.

Neither approach is universally superior. Live collection changes the system because commands execute, memory pages are allocated, logs may be written, and network connections may change. Dead-box collection loses volatile data and may trigger encryption or destruction mechanisms when power is removed. The defensible choice is the one whose risks are understood, documented, and proportionate to the investigative purpose.

The order of volatility

The order-of-volatility principle prioritizes evidence that is most likely to disappear or change first. A practical sequence is:

• CPU state, registers, and cache-related information, where obtainable;
• active memory and running processes;
• network connections, routing state, and temporary sessions;
• temporary files and system state;
• active application and security logs;
• persistent storage;
• removable media, backups, and archival records.

This ordering is a guide rather than an absolute law. A particular environment may make a disk more urgent than memory—for example, when remote destruction is occurring—or make cloud audit records more volatile because the retention period is short. Collection plans should therefore combine volatility with relevance, accessibility, legal authority, and risk.

Scope and proportionality

A forensic acquisition should be sufficiently complete to answer the authorized question, but unnecessary collection increases privacy exposure, storage costs, and review burdens. Full physical imaging may be appropriate for a seized device in a serious investigation, whereas targeted logical collection may be more proportionate during an enterprise incident involving thousands of endpoints. The decision should be recorded, including what was excluded and why.

Acquiring Storage Media

Preparation and isolation

Before connecting a storage device, the examiner records its make, model, serial number, capacity, interface, visible condition, and identifying labels. Photographs can document ports, seals, damage, and cable connections. The device should be isolated from networks and from systems that might automatically mount or modify it. The forensic workstation should have known configurations, synchronized time, adequate storage, validated acquisition software, and a destination drive prepared for the image.

A hardware write blocker prevents commands from writing to the source medium while allowing read operations. Software write protection can provide an additional control, but it depends on the operating environment and must be verified. A write blocker does not prove that the investigator has selected the correct source, nor does it protect against every device-specific behavior. Its use, model, serial number, mode, and verification result should be recorded.

Physical and logical acquisition

A physical image attempts to copy addressable sectors across a device, including allocated space, unallocated space, file-system structures, and potentially deleted remnants. It is valuable when deleted files, slack space, hidden partitions, encryption metadata, or unknown file systems may matter. A logical acquisition copies selected files, directories, or application records. It is faster and more targeted but may omit deleted material, unallocated areas, alternate data, and system structures.

A forensic image may be stored in a raw format or a forensic container format. Container formats can support compression, segmentation, metadata, and error reporting. Whatever format is selected, the examiner should document the source, acquisition tool and version, options, start and end times, errors, sectors that could not be read, destination, and verification results.

Handling damaged media

A failing disk should not be repeatedly interrogated with ordinary operating-system tools. Imaging may require a controlled recovery process that records read errors, retries, and substituted sectors. The investigator must distinguish between a complete image and a partial image. A partial image can be useful, but its limitations must remain visible in reports and later interpretation.

Volatile Memory and Live Systems

Memory acquisition can reveal running processes, injected code, credentials or tokens, encryption keys, open files, command history, network connections, and remnants of malware that never reached disk. It is especially important when a system is powered on or when full-disk encryption prevents meaningful dead-box access.

The capture tool should be appropriate to the operating system and architecture, and its execution should be recorded. The examiner notes the system time, time zone, logged-in users, network state, process list where feasible, and any commands used. Collection should proceed from the least disruptive actions to more intrusive ones. A trusted tool may be run from controlled media, although introducing the tool necessarily changes memory and may alter system state. This limitation is acknowledged rather than concealed.

Memory images require careful handling because their contents are highly sensitive and may include unrelated personal or organizational data. Analysis should use copies, and the original capture should be hashed, access-controlled, and retained according to policy. A memory image is not a complete record of everything that existed in memory; acquisition timing, tool behavior, hardware, and operating-system activity affect what is captured.

Logs and Remote Evidence

Local and centralized logs

Logs may be stored locally, forwarded to a security information and event management platform, retained by an endpoint detection system, or generated by a cloud provider. Before collecting them, the investigator identifies the logging source, format, time zone, synchronization method, retention policy, filtering rules, and administrator access. Exporting only search results can lose surrounding events and original metadata. When feasible, the original export and the query definition should be preserved together.

The examiner should record whether logs are append-only, cryptographically signed, access-controlled, or subject to rotation. Hashing an exported log proves the integrity of that export after collection; it does not prove that the source log was complete or that the logging system itself was trustworthy. Interpretation therefore requires corroboration from other systems.

Remote and cloud acquisition

Remote collection may involve endpoint agents, secure administrative access, network sensors, virtual-machine snapshots, cloud APIs, provider portals, or requests to a service provider. The investigator must establish authority, scope, tenant identity, account identity, region, retention status, and provider procedures. A cloud artifact may be generated by a provider rather than copied directly by the investigator, making provider attestations, export metadata, and audit trails important parts of the evidence package.

Remote acquisition introduces risks including changing data during collection, collecting from the wrong tenant, cross-border transfer, incomplete API results, pagination errors, clock differences, and loss of data when a virtual resource is terminated. The collection script, API endpoint, parameters, response metadata, tool version, and errors should be preserved. Screenshots may provide context but should not replace structured exports when the latter are available.

Hashing, Verification, and Evidence Packaging

A cryptographic hash is a fixed-length digest calculated from data. If the data changes, the digest will normally change. Hashes such as SHA-256 are commonly used to verify that an image or export remains identical to the acquired object. Hashes support integrity checking; they do not by themselves establish authenticity, relevance, completeness, or lawful possession.

Hash values should be calculated at acquisition and rechecked when evidence is transferred, mounted, copied, or presented for examination. A verification log should identify the algorithm, object, time, software, and result. Where a tool reports both source and image hashes, the examiner should understand exactly what each value represents. Hashing a file selected from a compromised system is different from hashing a complete disk image.

An evidence package normally includes the acquired object, cryptographic values, acquisition notes, photographs, device identifiers, tool and configuration information, error logs, chain-of-custody records, authorization, and a readme explaining the contents. The master copy should be write-protected or access-controlled, while analysis occurs on a verified working copy.

Chain of Custody and Documentation

Chain of custody is the chronological record of possession and handling. It identifies the evidence, its source, each transfer, the date and time, the person releasing it, the person receiving it, the purpose, the storage location, and the condition or integrity check. Digital records should be sufficiently precise to show not only who held an item but also what actions were performed.

Contemporaneous notes are preferable to reconstruction from memory. An examiner should record decisions and deviations, including why a live system was not shut down, why a targeted collection was selected, why a write blocker could not be used, or why a collection was repeated. Good documentation allows another competent examiner to understand and, where possible, reproduce the process.

An Illustrative Applied Case: Suspected Credential Theft

Background

A university research department reports that an employee account accessed a restricted repository from an unfamiliar location. The employee’s workstation is powered on, connected to the institutional network, and displaying an active session. The endpoint uses full-disk encryption, and the security team has observed a short-lived process associated with an unknown executable.

Situation and analysis

The incident commander must preserve volatile information without allowing continued access to the repository. Immediate shutdown would protect the disk from further remote activity but would remove memory, active connections, and the encryption context. The response team confirms authorization, isolates the workstation at the network control point, and records the time, system identity, screen state, and network address.

Approach

The team first captures volatile memory using a documented tool and records running processes and connections. It then collects relevant endpoint and authentication logs from the central logging platform, preserving the export query and time-zone information. After confirming that remote access has been disabled and that a dead-box image is authorized, the team shuts down the workstation, labels the storage device, and acquires a physical image through a verified write blocker. SHA-256 values are calculated for the image and memory capture. Analysis takes place on working copies.

Outcome

Memory analysis identifies a running process and a token associated with a temporary service. Authentication records show that the account was used from a second endpoint during the same interval. The disk image provides persistence artifacts and a script that explains how the token was obtained. No single artifact proves the entire sequence; the conclusion is supported by the correlation of memory, disk, endpoint, and authentication evidence.

Learning points

The case demonstrates that acquisition is a sequence of risk-based decisions. Isolation, rather than immediate shutdown, preserved volatile evidence while limiting further access. The team also avoided treating a hash as proof of truth: hashes verified the collected objects, while cross-source comparison supported interpretation.

Common Failure Modes and Constraints

Frequent mistakes include powering off a system before considering volatility, connecting a source disk without write protection, imaging the wrong device, failing to record time zones, relying only on screenshots, collecting filtered logs without preserving the query, overwriting the master image, and omitting tool versions. Another error is assuming that a successful acquisition is complete. Read errors, unsupported file systems, destroyed logs, encryption, and provider retention limits can all create gaps.

Operational urgency can conflict with evidential purity. An organization may need to remove malware, restore service, or rotate credentials before a full forensic acquisition is possible. This is acceptable when the decision is authorized, proportionate, and documented. Investigators should distinguish preservation actions from remediation actions and preserve relevant evidence before destructive remediation whenever circumstances permit.

Technical tools also have limitations. Acquisition software may misinterpret unusual storage technologies, memory tools may alter the running system, cloud APIs may return incomplete pages, and parsers may normalize timestamps incorrectly. Validation, independent verification, and cautious interpretation are therefore more important than reliance on a tool’s brand or interface.

Ethical, Legal, and Governance Considerations

Authority must precede collection. Depending on the setting, authority may arise from consent, employment policy, incident-response mandates, contractual terms, a warrant, a court order, or another lawful basis. Collection beyond that authority can expose organizations and investigators to legal, disciplinary, or reputational consequences.

Privacy and proportionality are particularly important when devices contain personal communications, health information, privileged material, or data belonging to uninvolved individuals. Access controls, segregation, minimization, redaction, and retention schedules should be applied. Cross-border cloud collection may invoke data-protection and disclosure requirements. Privileged or legally protected material should be handled under appropriate counsel-directed procedures.

Professional integrity requires that investigators preserve exculpatory as well as inculpatory information, report uncertainty, disclose collection limitations, and avoid altering evidence merely to make analysis easier. Evidence must not be fabricated, selectively omitted, or presented with a confidence greater than the method supports.

Automation, Tooling, and Emerging Practice

Automation improves consistency in large investigations. Endpoint orchestration can collect memory, process lists, hashes, and selected files across many hosts; APIs can preserve cloud audit records; and evidence-management systems can track custody and access. Automation must include authentication, scope controls, rate-limit handling, error reporting, and review of unusual results. A script that silently fails or collects from the wrong tenant can create a systematic evidential defect.

Machine learning can assist with triage, anomaly ranking, duplicate detection, and prioritization of artifacts. It should not replace preservation controls or expert judgment. Models may inherit incomplete data, produce unexplained classifications, or overlook rare but significant evidence. Current practice is also moving toward remote forensic readiness, immutable logging, hardware-backed attestation, tamper-evident storage, and standardized cloud evidence interfaces. These developments improve collection opportunities, but they do not remove the need for authority, documentation, validation, and human accountability.

Best-Practice Workflow

A defensible workflow can be summarized as follows:

1. Confirm the incident question, authority, scope, and safety requirements.

2. Identify potential sources and rank them by volatility, relevance, and accessibility.

3. Isolate systems where necessary while avoiding premature destruction of volatile evidence.

4. Record device, account, environment, time, and condition details.

5. Select live, dead-box, physical, logical, remote, or hybrid acquisition deliberately.

6. Use write protection and validated tools where applicable.

7. Capture volatile data before less volatile data when the investigative value justifies it.

8. Preserve original exports, metadata, error reports, and collection parameters.

9. Calculate and record cryptographic hashes using a strong contemporary algorithm.

10. Protect the master acquisition and analyze verified working copies.

11. Maintain a complete chain of custody and contemporaneous notes.

12. State limitations, uncertainties, and deviations in the final report.

Chapter Summary

Evidence identification, acquisition, and preservation form the foundation of defensible digital investigation. Investigators must identify relevant sources, choose between live and dead-box methods, and apply the order of volatility without treating it as a rigid rule. Storage acquisition may be physical or logical; write blockers reduce the risk of modification; memory capture preserves transient state but changes the live system; and remote or cloud collection requires attention to authority, tenant identity, provider processes, and export completeness. Cryptographic hashes verify the stability of acquired objects, while chain of custody and contemporaneous documentation establish provenance and accountability. Effective practice combines technical controls with proportionality, privacy protection, validation, and honest reporting of limitations.

Key Terms

Potential evidence: Information that may become relevant to an investigation but has not yet been assessed or collected.

Forensic acquisition: Controlled collection of digital information for examination and possible evidential use.

Dead-box acquisition: Collection from a powered-down or offline system.

Live acquisition: Collection while a system remains powered and operational.

Order of volatility: A prioritization method that collects the most transient information first.

Write blocker: Hardware or software control designed to prevent writes to a source medium.

Physical image: A sector-level representation of a storage device.

Logical acquisition: Collection of selected files, records, or directories rather than all addressable sectors.

Unallocated space: Storage areas not currently assigned to active files by a file system.

Volatile memory: Temporary working memory whose contents may disappear when power is removed.

Cryptographic hash: A fixed-length digest used to detect changes in digital data.

Integrity: The condition of remaining complete and unaltered.

Authenticity: The quality of being what the evidence is claimed to be.

Provenance: Information describing an item’s origin, history, and handling.

Chain of custody: A chronological record of evidence possession and transfer.

Master copy: The protected original acquisition retained for evidential integrity.

Working copy: A verified duplicate used for examination and analysis.

Targeted collection: Acquisition limited to defined sources or data categories.

Remote acquisition: Collection from a system or service without direct physical possession.

Order of volatility: A prioritization model for transient and persistent evidence.

Review Questions

Short Answer Questions

1. Distinguish potential evidence from acquired evidence.

2. What is the primary purpose of a write blocker?

3. Why can live acquisition alter the system being investigated?

4. What does a cryptographic hash verify?

5. Identify four categories of information commonly collected from volatile memory.

Long Answer Questions

1. Explain the factors that should guide the choice between live and dead-box acquisition.

2. Describe a defensible process for acquiring and preserving a physical disk image.

3. Explain how chain of custody, hashing, and contemporaneous notes work together.

4. Discuss the technical and governance challenges of acquiring cloud or remote evidence.

5. Compare physical and logical acquisition, including their investigative advantages and limitations.

Analytical / Application Questions

1. A powered-on encrypted laptop is suspected of running malware, while an attacker is still connected. Design an acquisition and containment sequence and justify its order.

2. A cloud audit export contains relevant events but no provider statement about retention or completeness. Assess what conclusions can safely be drawn and what additional information should be requested.

3. An examiner discovers after imaging that the source disk was connected without a write blocker. Evaluate the evidential risks, propose remedial steps, and explain how the incident should be reported.

22. Multiple Choice Questions with Answers

Question 1

Which acquisition decision best reflects the order-of-volatility principle?

A. Collect archival backups before examining memory

B. Capture running memory before powering down the system

C. Image removable media before recording network connections

D. Export deleted files before documenting the system state

Correct Answer: B. Capture running memory before powering down the system

Question 2

What does a write blocker primarily provide during disk acquisition?

A. Proof that the disk contains authentic evidence

B. Automatic recovery of all deleted files

C. Protection against writes to the source medium

D. Encryption of the forensic image

Correct Answer: C. Protection against writes to the source medium

Question 3

Why is a hash value alone insufficient to establish the truth of a log entry?

A. Hashes cannot be calculated for digital data

B. A hash verifies stability but not source completeness or meaning

C. Hashes always change when a file is copied

D. A hash identifies the person who created the log

Correct Answer: B. A hash verifies stability but not source completeness or meaning

Question 4

Which situation most strongly supports live acquisition?

A. A powered-down device with no encryption

B. A retained backup stored offline

C. A running system containing important encryption keys in memory

D. An archived disk already protected in evidence storage

Correct Answer: C. A running system containing important encryption keys in memory

Question 5

What is a major limitation of logical acquisition compared with physical imaging?

A. It cannot collect any active files

B. It may omit deleted data and unallocated space

C. It always modifies the source disk

D. It cannot be verified with hashes

Correct Answer: B. It may omit deleted data and unallocated space

Question 6

An investigator exports cloud logs using a query but preserves only the displayed results. What is the principal weakness?

A. The results cannot contain timestamps

B. The export may lack surrounding events and the query context

C. Cloud logs cannot be used as evidence

D. The export is automatically invalid if it is not a disk image

Correct Answer: B. The export may lack surrounding events and the query context

Question 7

Which item belongs most directly in a chain-of-custody record?

A. The investigator’s preferred analytical theory

B. The device’s likely future replacement date

C. Each transfer, handler, time, purpose, and storage location

D. A list of unrelated incidents in the organization

Correct Answer: C. Each transfer, handler, time, purpose, and storage location

Question 8

A disk image has a matching SHA-256 value after transfer. What conclusion is most justified?

A. The image is unchanged since the recorded hash was generated

B. The image contains only legally admissible information

C. The original system was not compromised

D. Every relevant artifact was successfully collected

Correct Answer: A. The image is unchanged since the recorded hash was generated

Question 9

Why should analysis normally be performed on a working copy?

A. To allow alteration of the master image during parsing

B. To protect the master acquisition from investigative changes

C. To avoid documenting analytical actions

D. To eliminate the need for source identification

Correct Answer: B. To protect the master acquisition from investigative changes

Question 10

During an incident, an examiner shuts down a live system before capturing memory. What is the most important limitation to document?

A. The system may have lost volatile processes, connections, and keys

B. The disk can no longer be hashed

C. A write blocker becomes impossible to use

D. All persistent files are automatically destroyed

Correct Answer: A. The system may have lost volatile processes, connections, and keys