Forensic Fundamentals and Chain of Custody

Digital forensics is the disciplined recovery, preservation, and analysis of digital evidence so that findings hold up under scrutiny, including in court.

It is not just data recovery. The defining requirement is defensibility: every action must be documented, repeatable, and unbiased.

• Identification of relevant evidence sources
• Preservation without alteration
• Analysis using validated methods
• Presentation in clear, reproducible reports

When responding to a live incident, collect evidence from the most volatile to least volatile source. Data that disappears fastest must be captured first.

• CPU registers and cache
• Routing table, ARP cache, process list, network connections
• RAM (memory)
• Temporary file systems
• Disk
• Remote logging and archival media

RFC 3227 codifies this principle. Pull the disk image too early and you lose live RAM artifacts forever.

The chain of custody is the documented chronological record showing who handled evidence, when, why, and what they did to it.

A single gap can render evidence inadmissible. Every transfer is logged.

• Who collected and received the item
• What the item is (serial, hash, description)
• When each handoff occurred
• Where it was stored
• Why custody changed

Cryptographic hashes prove evidence has not changed. You hash at acquisition and re-hash later; matching values prove integrity.

Use SHA-256 as the modern standard. MD5 and SHA-1 still appear in legacy tools but are collision-weak; many labs record both for cross-verification.

A write blocker sits between the investigator and the evidence drive, permitting reads while physically or logically denying writes. This guarantees the original is never modified during acquisition.

• Hardware write blockers are inline devices, preferred for court work
• Software write blockers set the OS to read-only mount

Even mounting a drive normally can update access timestamps, so a blocker is mandatory for original media.

The golden rule: analyze a verified copy, preserve the original. The original goes into evidence storage and is touched as little as possible.

Best practice is to make at least two copies: one working image for analysis and one archival master kept untouched. Both must hash-match the source.

Contemporaneous notes are evidence too. Record actions as you perform them, not from memory afterward.

• Timestamp every action (use UTC to avoid ambiguity)
• Photograph the scene and device state
• Note tool names and versions
• Record any anomalies or errors

If it is not written down, in court it effectively did not happen.

Before touching anything, confirm legal authority: a warrant, consent, internal authorization, or applicable regulation. Exceeding scope can taint the entire case and expose the investigator to liability.

Forensics is bound by jurisdiction. Cross-border data, employee privacy expectations, and data protection law (GDPR, KVKK) all constrain what you may collect and how.

Findings must be repeatable: another examiner using validated tools on the same evidence should reach the same conclusion.

This is why labs use known-good, version-controlled tools (NIST CFTT-tested where possible) and document tool versions. Custom or unvetted scripts undermine defensibility.

A dedicated, isolated workstation prevents cross-contamination and accidental network leakage of evidence.

• Air-gapped or tightly firewalled
• Sterilized (wiped + verified) target media for images
• Validated toolset (Autopsy, Sleuth Kit, Volatility, Wireshark)
• Logged access

Integrity must be provable not just at acquisition but throughout storage. Re-hash periodically and after every transfer, comparing against the acquisition baseline.

• Tamper-evident seals on physical media
• Access-controlled, logged evidence storage
• Recorded hash at each custody handoff

If a later hash diverges from the original, the evidence is treated as compromised and its findings are challenged.

Test your understanding of acquisition order.

You covered the foundations of defensible forensics:

• Order of volatility drives collection sequence
• Chain of custody documents every handoff
• Hashing (SHA-256) proves integrity
• Write blockers protect originals
• Always work on verified copies
• Documentation, legal scope, and repeatability make evidence admissible

Next: turning these principles into actual disk images and artifact recovery.