Evidence Collection and Chain of Custody

Digital evidence collected during incident response may be used in legal proceedings, HR actions, or regulatory reviews. Evidence must be collected, preserved, and documented following proper procedures to maintain its admissibility and integrity.

Evidence categories:

• Volatile: RAM contents, running processes, network connections — lost on reboot
• Non-volatile: disk images, log files, database records
• Network: packet captures, NetFlow records
• Application: access logs, audit logs, emails

Collect volatile data before powering off a system:

Create a forensic image (bit-for-bit copy) of storage media. Use write blockers to prevent any modification of the original. Verify with hash:

A write blocker is a hardware or software device that prevents any writes to the evidence media during imaging. Without a write blocker, the imaging process itself might modify access timestamps or other metadata, contaminating the evidence.

The chain of custody documents every person who handled evidence, when, and why. It includes:

• Evidence identifier and description
• Date/time of collection
• Collected by (name, signature)
• Storage location
• Transfer records (who received it, when)

Preserving evidence:

• Store originals in sealed, labeled evidence bags
• Work only on verified copies
• Store in secure, access-controlled locations
• Document hash values for integrity verification
• Never work from the original evidence media

Logs are often the most valuable evidence. Preserve:

When litigation or regulatory investigation is anticipated, issue a legal hold — a directive to preserve all potentially relevant records. This suspends normal data retention schedules. Failure to preserve can result in spoliation charges.

Common forensic tools:

• Autopsy/Sleuth Kit — disk forensics
• Volatility — memory analysis
• Wireshark — packet capture analysis
• FTK Imager — disk imaging
• SIFT Workstation — Ubuntu-based forensic distro

Mobile devices require specialized handling: enable airplane mode to prevent remote wipe, place in a Faraday bag to block signals. Use mobile forensics tools (Cellebrite, Oxygen Forensic) that understand mobile file systems and app data structures.

Why must volatile memory (RAM) be collected before other evidence types?

Evidence collection must follow proper procedures to be admissible. Collect volatile data (RAM, processes, connections) first — it disappears on reboot. Use write blockers for disk imaging. Maintain chain of custody documentation. Hash everything to prove integrity. Legal hold suspends data deletion. Work only on verified copies, never originals.