Evidence Acquisition and Preservation

Introduction

Digital evidence is information of potential evidential value stored or transmitted in digital form. It may exist on laptops, mobile devices, servers, cloud platforms, removable media, network equipment, embedded systems, or Internet-connected services. Unlike many physical exhibits, digital evidence can be altered by ordinary system operation, remote access, malware, automatic synchronization, or investigator error. Acquisition and preservation therefore determine whether later examination is technically reliable and legally defensible.

Evidence acquisition is the controlled process of identifying, collecting, copying, and recording digital information. Preservation is the set of measures used to maintain the evidence’s integrity, authenticity, availability, and provenance from collection through presentation. The central professional principle is that an examiner should preserve the original whenever possible and conduct analysis on a verified working copy.

This chapter presents a defensible acquisition lifecycle covering live, dead-box, physical, logical, and remote acquisition. It explains write blockers, forensic imaging, hashing, verification, encryption, damaged media, volatile evidence, anti-forensic risks, documentation, and reproducibility.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish live, dead-box, physical, logical, and remote acquisition.

2. Select an acquisition method according to evidential objectives, risk, device state, and authority.

3. Use write blockers, forensic imagers, hashing, and verification appropriately.

4. Plan the collection of volatile evidence without unnecessarily changing the system.

5. Address encryption, damaged media, anti-forensic activity, and failed acquisition.

6. Maintain chain of custody, repeatability, and quality assurance.

7. Evaluate the legal, ethical, privacy, and governance implications of acquisition.

1. The Acquisition and Preservation Model

A defensible process normally consists of the following stages:

Preparation. Define the investigative question, authority, scope, personnel, equipment, time constraints, and safety requirements. Confirm that destination storage has sufficient capacity and that tools are validated and properly configured.

Identification. Locate potentially relevant devices, accounts, media, services, and volatile sources. Record identifiers such as serial numbers, asset tags, network addresses, user accounts, and physical condition.

Prioritization. Decide which sources should be collected first. Volatile information, such as memory contents and active network connections, may disappear when power is removed. Other evidence, such as a powered-off disk, is comparatively stable.

Collection and acquisition. Obtain the evidence using a method appropriate to the source. Record every action, tool, version, setting, time reference, error, and person involved.

Verification. Calculate cryptographic hashes of acquired data and, where possible, compare them with hashes calculated from the source or from a second acquisition. Verification demonstrates that a copy has not changed; it does not by itself prove that the original data was authentic or relevant.

Preservation and storage. Seal the original or source device, restrict access, maintain environmental controls, and store verified copies in controlled evidence repositories. Examination should occur on working copies.

Review and reporting. Preserve acquisition logs, hash values, tool output, photographs, authorization documents, and deviations. A competent examiner should be able to understand and, where practicable, reproduce the acquisition.

1.1 Evidence attributes

Four attributes are particularly important:

• Integrity: the data has not been improperly changed.
• Authenticity: the data can be associated with the claimed source and collection process.
• Provenance: the history of possession, handling, and transformation is documented.
• Reproducibility: another competent examiner can repeat the process or independently verify its material results.

Integrity is not identical to authenticity. A perfectly hashed file can be a fabricated file if it was created before hashing. Authenticity depends on context, source identification, reliable procedures, corroboration, and continuity of custody.

2. Acquisition Types and Selection

2.1 Dead-box acquisition

Dead-box acquisition examines a device that is powered off. The examiner connects storage media to a forensic workstation, preferably through a hardware or appropriately configured software write blocker, and creates an image without booting the suspect operating system. This approach minimizes changes to files, timestamps, logs, and system state.

Its principal advantages are repeatability, low alteration risk, and the ability to acquire unallocated space, slack space, deleted remnants, file-system metadata, and sometimes hidden areas. Its limitations include loss of volatile memory, disappearance of live network state, and possible inability to access data protected by full-disk encryption when the system is powered off.

A powered-on encrypted system may therefore contain accessible keys in memory. Turning it off can make otherwise recoverable data inaccessible. The decision must balance preservation of volatile evidence against the risk of continuing system activity.

2.2 Live acquisition

Live acquisition is performed while the system is running. It may collect RAM, logged-in sessions, running processes, open files, network connections, mounted volumes, encryption status, and selected files. It is especially valuable where encryption, ephemeral cloud tokens, malware, or volatile communications are involved.

Live acquisition necessarily changes the system. Executing a tool consumes memory, creates processes, may modify logs, and can alter timestamps or caches. It should therefore be planned, minimized, documented, and performed with trusted media and tools. The examiner should record system time, time zone, power state, visible applications, network status, and the exact commands or utilities used.

A live response is not a substitute for a full forensic image. It is often a complementary collection that captures information unavailable after shutdown.

2.3 Physical acquisition

A physical acquisition copies addressable storage sectors or equivalent low-level units, including allocated and unallocated areas. It may recover deleted material, file-system remnants, partition structures, hidden content, and data not represented in the active file system.

Physical imaging is affected by sector errors, host-protected areas, device firmware behavior, encryption, wear-leveling, and solid-state-drive garbage collection. For solid-state media, deletion and recovery behavior may be influenced by TRIM and controller-level processes; a physical image is not guaranteed to contain historical data once the controller has discarded it.

2.4 Logical acquisition

Logical acquisition collects files, directories, database records, application data, or selected objects through a file system, operating-system interface, application interface, or provider API. It is faster and often requires less storage than physical imaging, but it may omit deleted data, slack space, hidden partitions, unallocated sectors, and artifacts outside the selected scope.

Logical acquisition is appropriate when the investigative question concerns defined records, when physical access is unavailable, or when a service provides only an export interface. Its scope must be explicitly documented. A logical copy should never be described as a complete image unless it actually represents the complete addressable source.

2.5 Remote acquisition

Remote acquisition collects data over a network from an endpoint, server, virtual machine, cloud service, or managed platform. It may use endpoint agents, secure administrative tools, provider APIs, snapshots, or legal preservation requests.

Remote methods reduce the need for physical access but introduce dependence on network reliability, provider processes, clocks, authentication, permissions, jurisdiction, and the provider’s implementation. The examiner must preserve API responses, export manifests, account identifiers, query parameters, collection time, provider statements, and any transformations applied during export.

A remote snapshot can be operationally useful, but a snapshot is not automatically a forensic image. Its consistency model, inclusion of deleted blocks, encryption, access controls, and provider documentation must be understood.

2.6 A decision framework

Selection should be driven by the evidential question rather than by convenience. Ask:

1. What information is required: active files, deleted data, RAM, keys, logs, or provider records?

2. Is the system powered on, networked, encrypted, damaged, or actively changing?

3. What authority and privacy limits apply?

4. What alteration is unavoidable, and how will it be measured and reported?

5. Can the source be safely removed, or must acquisition occur remotely?

6. Is a full image necessary, or is a scoped logical collection proportionate?

A layered strategy is common: document and collect volatile state, preserve a full physical source where feasible, and obtain targeted logical or remote collections for rapid analysis and corroboration.

3. Write Protection and Forensic Imaging

3.1 Write blockers

A write blocker prevents commands from the examiner’s system from modifying the evidence source. Hardware write blockers operate between the source and host and are generally preferred because their enforcement is independent of the host operating system. Software write protection can be useful where hardware support is unavailable, but it requires careful configuration and validation.

A write blocker must be tested with a known device before use and its make, model, serial number, firmware, connection mode, and test result recorded. A blocker may not prevent changes caused by the source device itself, firmware processes, encryption controllers, or specialized commands. It also may not support every interface or protocol. The examiner must understand its limitations rather than treating the label “write blocker” as absolute assurance.

3.2 Image formats and acquisition choices

A raw image is a sector-by-sector representation with minimal interpretation. It is broadly interoperable but may require separate metadata. Specialized forensic formats can store metadata, compression, segmentation, bad-sector information, and acquisition logs. Compression changes storage representation but should not change the logical evidence; the format and tool must be documented.

The destination should be clean, access-controlled, sufficiently large, and itself checked before use. Evidence and output should be separated when practical. The original should be mounted read-only, and the image should be written to controlled destination media.

A typical imaging record includes source identifiers, destination identifiers, examiner, date and time, time zone, acquisition method, tool and version, write-blocker details, image format, segment size, start and end conditions, hash algorithms, errors, retries, and verification results.

3.3 Handling read errors

A failing disk should not be repeatedly stressed with ordinary operating-system copy utilities. A forensic imager may use controlled retries, skipping and later revisiting bad sectors, or a hardware-assisted recovery workflow. The examiner should preserve the error map and distinguish unreadable regions from successfully acquired regions.

A partial image can be valuable, but it must be reported as partial. It is misleading to describe missing sectors as blank data. Where repair or controller intervention is required, the process should be performed by a specialist and all intervention should be documented because it may alter the source.

4. Hashing and Verification

A cryptographic hash is a fixed-length digest calculated from a sequence of bytes. Modern forensic workflows commonly use SHA-256 or another approved cryptographic hash; older algorithms such as MD5 or SHA-1 may remain useful for legacy comparison or known-file databases but have known collision weaknesses and should not be the sole integrity control for new work.

If a hash function is represented as H and the byte sequence as D, the digest is:

H(D) = h

The equation defines the operation, not a probability claim. A useful cryptographic hash is designed so that changing the input ordinarily changes the digest and finding a different input with the same digest is computationally difficult under the relevant threat model. Hashes do not encrypt data, reveal whether collection was authorized, or prove that the source was not altered before collection.

At minimum, calculate and record hashes for the acquired image. Where technically feasible, calculate a source hash during acquisition and a destination-image hash after acquisition. Matching values provide evidence that the compared byte sequences are identical. A subsequent working-copy hash can demonstrate that the working copy matches the verified image.

Verification should also include structural checks: image readability, expected size, partition recognition, file-system consistency where appropriate, and review of acquisition errors. A matching hash cannot detect an acquisition that faithfully copied the wrong device, omitted an intended source, or was made under an incorrect scope.

Worked example: image verification

An examiner acquires a storage device into image file I. The SHA-256 digest calculated immediately after imaging is `A`. A second digest calculated after transferring I to an evidence repository is also `A`. The result supports byte-for-byte integrity of the transferred image. If a later working copy produces digest `B`, the copy must not be used until the discrepancy is investigated. Possible causes include corruption, an incomplete transfer, a different file representation, or an incorrect file being hashed. The examiner should preserve both values and the investigation record rather than simply recalculating until a desired result appears.

5. Volatile Evidence and Order of Volatility

Volatile evidence disappears or changes rapidly. Examples include CPU state, RAM, encryption keys, running processes, network connections, ARP and routing tables, temporary files, clipboard contents, ephemeral credentials, and cloud session tokens. A practical order of volatility places rapidly changing information before stable storage, but the order is not universal: the best sequence depends on the system, threat, tool, and investigative objective.

A live collection plan may include:

• photographs and screen documentation;
• system time and time zone;
• logged-in users and sessions;
• processes, services, and loaded modules;
• network connections, routes, and interfaces;
• mounted volumes and encryption status;
• RAM capture;
• selected logs and temporary data;
• persistent storage imaging.

The order should minimize disturbance. Trusted tools should be executed from controlled media where possible. Output should be directed to separate media or a secure remote destination, and commands should be logged. RAM acquisition can be technically intrusive and may fail because of hardware protections, virtualization, operating-system restrictions, or insufficient destination capacity. A failed attempt must be recorded; it should not be silently omitted from the report.

6. Encryption, Authentication, and Access Control

Encryption changes acquisition strategy rather than eliminating the evidence. Relevant conditions include full-disk encryption, file-level encryption, encrypted archives, mobile secure enclaves, cloud-side encryption, and application-level end-to-end encryption.

For a live system, keys may exist in RAM or in an unlocked volume. The examiner should document the lock state and consider lawful collection of memory and mounted-volume contents before shutdown. For a powered-off device, the examiner should preserve the device and avoid speculative password attacks that may trigger lockouts, remote wiping, or destruction. Credentials, recovery keys, escrow records, enterprise management systems, backups, and lawful provider processes may offer legitimate access paths.

Access must be authorized. Possession of a device does not automatically authorize bypassing a password or collecting unrelated accounts. Encryption keys and credentials are sensitive evidence and must receive access controls comparable to the protected data.

7. Anti-Forensic Risks

Anti-forensic activity attempts to obstruct identification, acquisition, interpretation, or attribution. Examples include secure deletion, wiping, timestamp manipulation, encryption, hidden partitions, steganography, log tampering, file-system deception, malware-based evidence destruction, remote wiping, and deliberate use of misleading filenames.

Controls include preserving the source early, collecting logs and volatile state, comparing multiple time sources, examining file-system metadata and unallocated space, checking for wiping tools and unusual utilities, preserving provider and network records, and correlating independent evidence. The absence of a file is not proof that it never existed. A wiped region may still produce artifacts such as tool logs, event records, filesystem metadata, or external backups, but conclusions must remain cautious.

Examiners should avoid “heroic” recovery that changes the source without authorization. Anti-forensic suspicion is a reason for additional validation, not a license to disregard procedure.

8. Chain of Custody, Documentation, and Reproducibility

Chain of custody records who possessed evidence, when, why, where, and what action was taken. Each transfer should identify the item unambiguously and record signatures or authenticated electronic approvals. Seals, tamper-evident packaging, access logs, and environmental records strengthen continuity.

A reproducible acquisition record should allow an independent examiner to reconstruct the decision and method. It should include:

• authority, scope, and investigative question;
• photographs, identifiers, and physical condition;
• date, time, time zone, and clock observations;
• acquisition type and justification;
• tools, versions, configurations, and validation status;
• write-blocker details and test results;
• source, destination, image format, and storage locations;
• hashes, errors, retries, and verification results;
• deviations, limitations, and corrective actions;
• names, roles, and signatures of participants.

Reproducibility does not require another examiner to obtain identical volatile content hours later. It requires transparent documentation of what was done, what could be repeated, and what conditions made exact repetition impossible.

9. Applied Case: Illustrative Ransomware Investigation

Background

An organization reports that a finance laptop connected to a file server was used shortly before ransomware encrypted shared documents. The laptop is powered on, connected to the network, and displays a ransom note. Full-disk encryption is enabled when the device is shut down.

Problem

Investigators must preserve memory-resident keys, malicious processes, network connections, and user sessions while avoiding unnecessary alteration. They also need a defensible storage acquisition and evidence from the server and cloud backup platform.

Analysis

Immediate shutdown could preserve the powered-off disk state but lose RAM-resident keys, running malware, and active connections. Leaving the laptop connected could permit continued encryption or remote wiping. The response therefore requires isolation rather than an unplanned shutdown.

Approach and solution

Authorized responders photograph the screen, record the device identity and visible time, and isolate network access using a documented containment method that does not unnecessarily power off the system. They collect volatile information using validated tools, including RAM, processes, connections, mounted volumes, and encryption status. Tool output is written to controlled response media and hashed.

They then perform a controlled shutdown only after the volatile collection and decision are documented. The storage device is removed and acquired through a tested hardware write blocker. The imager records unreadable sectors and produces a forensic image. The image and volatile captures receive SHA-256 hashes, and working copies are created for analysis.

Server logs, authentication records, endpoint telemetry, and cloud backup metadata are collected through authorized exports. Provider manifests, API queries, timestamps, and account identifiers are preserved. Investigators compare laptop activity with server events and backup records rather than relying solely on the ransom note.

Outcome

The memory capture reveals a process and an encryption key associated with the active malware. The disk image provides persistence artifacts and deleted scripts. Server logs establish the account and time window used to access shared files, while cloud records show that a clean backup existed before encryption. The report distinguishes facts directly observed in each source from interpretations based on correlation.

Learning points

The case demonstrates that acquisition is a strategic decision under changing conditions. Live and dead-box methods can be complementary. Isolation can be preferable to immediate shutdown, but it must be authorized and recorded. Hashes, logs, provider records, and acquisition documentation collectively support integrity and provenance; no single control is sufficient.

10. Limitations, Governance, and Professional Practice

Acquisition is constrained by device damage, proprietary interfaces, cloud tenancy, legal jurisdiction, privacy, limited storage, time pressure, and changing technology. A technically complete collection may be disproportionate if it captures large volumes of unrelated personal or third-party data. Scope limitation, minimization, filtering, and access controls should be designed with legal counsel, data-protection officers, and investigators where appropriate.

Evidence collection may involve personal data, privileged communications, health information, trade secrets, or data belonging to uninvolved persons. Examiners should follow applicable law, warrants, organizational policy, provider terms, and professional codes. They should segregate privileged or restricted material, limit analyst access, encrypt evidence at rest and in transit, and maintain audit logs.

Quality assurance includes validated tools, competent personnel, peer review, controlled laboratories, documented standard operating procedures, proficiency testing, and incident reporting. Automation can reduce repetitive error, but automated collection scripts and AI-assisted triage must be validated. AI output is an investigative aid, not an independent proof of authenticity. Any model, prompt, version, transformation, and human review relevant to a conclusion should be recorded. Sensitive evidence should not be sent to an external AI service without explicit authorization and suitable contractual and security controls.

11. Best-Practice Checklist

Before acquisition, confirm authority, objectives, risks, equipment, destination capacity, time synchronization, and safety. During acquisition, minimize changes, use tested write protection, record actions, preserve volatile information when justified, and capture errors rather than hiding them. After acquisition, hash and verify, preserve originals and logs, restrict access, create working copies, document limitations, and conduct independent quality review.

A sound examiner is not judged by claiming that no change occurred. Live collection and many remote methods necessarily cause change. Professional defensibility comes from selecting a proportionate method, understanding its effects, measuring or documenting those effects, and explaining why the resulting evidence remains fit for its intended purpose.

Chapter Summary

Evidence acquisition and preservation form the foundation of digital forensic reliability. Dead-box acquisition minimizes alteration but can lose volatile evidence and encryption keys. Live acquisition captures transient state but changes the system and must be carefully controlled. Physical imaging provides low-level coverage, whereas logical and remote acquisition are scoped, efficient alternatives with important limitations.

Write blockers reduce host-induced modification and must be tested rather than assumed reliable. Forensic images should be created with validated tools, documented settings, and controlled destinations. Cryptographic hashes support integrity comparisons, but they do not prove authenticity, authorization, or correct source selection. Verification should include hashes, structural checks, and review of errors.

Encryption, damaged media, anti-forensic actions, cloud dependence, privacy, and jurisdiction require strategic judgment. Chain of custody, detailed acquisition records, secure storage, access control, and reproducibility transform a technical copy into defensible evidence. Effective practice is therefore both technical and governance-oriented: preserve the source, explain unavoidable change, validate the process, and maintain an auditable history.

Key Terms

Acquisition: Controlled collection or copying of digital evidence.

Anti-forensics: Actions intended to conceal, destroy, distort, or obstruct digital evidence.

Chain of custody: Documented history of evidence possession, transfer, and handling.

Dead-box acquisition: Collection from a powered-off device.

Digital evidence: Digital information with potential relevance to an investigation or proceeding.

Forensic image: A documented copy of digital storage or data created for examination.

Hash: Fixed-length digest calculated from data for comparison and integrity checking.

Integrity: Confidence that data has not been improperly altered.

Logical acquisition: Collection of selected files, records, or objects through an interface or file system.

Live acquisition: Collection while a system is powered on and operating.

Order of volatility: A risk-based priority for collecting data that changes or disappears rapidly.

Physical acquisition: Low-level collection of addressable storage contents.

Provenance: Origin and documented history of evidence.

Remote acquisition: Network-based collection from an endpoint, server, cloud, or managed service.

Reproducibility: Ability of another competent examiner to understand and repeat the material process.

Volatile evidence: Information likely to change or disappear when a system or process changes.

Write blocker: Hardware or software control designed to prevent writes to evidence media.

Working copy: Verified duplicate used for examination instead of the preserved original.

Review Questions

Short Answer Questions

1. What is the principal difference between physical and logical acquisition?

2. Why can shutting down an encrypted computer destroy access to useful evidence?

3. What does a cryptographic hash demonstrate, and what does it not demonstrate?

4. State two functions of a write blocker.

5. Why should acquisition errors and unreadable sectors be documented?

Long Answer Questions

1. Compare live and dead-box acquisition, including benefits, risks, and appropriate use cases.

2. Explain how chain of custody and reproducibility contribute to evidential reliability.

3. Describe a complete workflow for imaging a storage device through a hardware write blocker.

4. Discuss the acquisition implications of full-disk encryption and live system state.

5. Explain why remote and cloud acquisition requires preservation of provider metadata and export context.

Analytical / Application Questions

1. A powered-on laptop is encrypting files and is protected by full-disk encryption. Design and justify an acquisition sequence that balances volatile evidence, continued damage, and preservation.

2. An image hash matches the destination hash, but the examiner later discovers that the wrong device was connected. Analyze what the hash proves and identify the corrective actions required.

3. A damaged disk produces an image with several unreadable regions. Propose a defensible recovery and reporting strategy, including limitations and quality controls.

Multiple Choice Questions with Answers

Question 1

Which acquisition method generally provides the broadest access to allocated, unallocated, and deleted storage remnants?

A. Logical acquisition

B. Physical acquisition

C. Screen capture

D. Provider metadata export

Correct Answer: B. Physical acquisition

Question 2

What is the primary purpose of a write blocker?

A. To encrypt the forensic image

B. To prevent host commands from modifying the evidence source

C. To recover deleted files automatically

D. To synchronize system clocks

Correct Answer: B. To prevent host commands from modifying the evidence source

Question 3

Which item is typically volatile evidence?

A. A powered-off disk partition

B. A printed asset tag

C. A running process list in RAM

D. A sealed evidence bag

Correct Answer: C. A running process list in RAM

Question 4

A matching SHA-256 hash between an image and its transferred copy most directly supports which conclusion?

A. The correct device was originally selected

B. The compared byte sequences are identical

C. The data was legally collected

D. The source was authentic before collection

Correct Answer: B. The compared byte sequences are identical

Question 5

Why can live acquisition be valuable on a system using full-disk encryption?

A. It guarantees that no system changes occur

B. It may capture unlocked volumes or keys present in memory

C. It automatically bypasses all legal restrictions

D. It always recovers deleted sectors

Correct Answer: B. It may capture unlocked volumes or keys present in memory

Question 6

Which statement best describes logical acquisition?

A. It always includes every unallocated sector

B. It collects selected files, records, or objects through an interface

C. It can only be performed on powered-off devices

D. It never depends on provider software

Correct Answer: B. It collects selected files, records, or objects through an interface

Question 7

What should an examiner do when a forensic image contains unreadable sectors?

A. Represent the sectors as known blank data without notation

B. Hide the errors to preserve a clean report

C. Record the errors, recovery attempts, and resulting limitations

D. Automatically claim the entire source was acquired

Correct Answer: C. Record the errors, recovery attempts, and resulting limitations

Question 8

Which statement about hashes is correct?

A. A hash is a reversible encryption method

B. A hash proves that collection was authorized

C. A hash supports comparison of data integrity

D. A hash identifies the person who created a file

Correct Answer: C. A hash supports comparison of data integrity

Question 9

Why should a remote acquisition preserve API queries and provider manifests?

A. They document the scope and context of the provider export

B. They make encryption unnecessary

C. They guarantee that deleted data was included

D. They replace chain-of-custody records

Correct Answer: A. They document the scope and context of the provider export

Question 10

What is the most defensible use of a forensic working copy?

A. Use it for examination while preserving the original or verified source

B. Modify it and overwrite the original to save storage

C. Treat it as authentic without verification

D. Delete acquisition logs after analysis

Correct Answer: A. Use it for examination while preserving the original or verified source