Chain of custody

Trace the handling, not just the file contents

Chain of custody records the collection, transfer, storage, and handling of evidence. It helps explain where material came from, who controlled it, and what happened to it during an investigation. The required procedures depend on the investigation and the organization's approved process.

A digest can support a claim that particular bytes remained unchanged between recorded checks. It cannot identify every person who accessed a storage location or explain why a copy was created. Cryptographic hashing and custody records answer related but different questions.

A copied disk image changes hands

Imagine a fictional investigator, Sam, collects an authorized disk image from a workstation. The acquisition record identifies the source, relevant times, method, output, and checks performed. The image receives an evidence identifier that can be used consistently in later records.

Sam transfers an analysis copy to Priya. A useful handover record identifies the material, sender, recipient, time, purpose, and applicable integrity information. Priya verifies the received material according to the approved process and records the result before analysis.

If a digest mismatch appears, Priya should investigate and document it rather than replacing the expected value with the new result. The mismatch is evidence of a difference; the response should explain the difference or its unresolved status.

Original material and working copies

An investigation may create multiple copies or derived artifacts. For example, Priya exports a subset of events from the disk image into a timeline. The export is not the original image, and its identifier and relationship to the source should remain clear.

The investigator needs to distinguish preservation copies, working copies, and outputs created by analysis. Evidence acquisition covers collection decisions, while Forensic reporting explains how to present findings and methods. Consistent identifiers prevent a later reader from confusing one object with another.

Storage and access are part of the story

A handover form is less informative if the evidence then sits in an uncontrolled shared folder. The organization needs storage and access arrangements appropriate to the material and investigation. Record relevant access and handling according to the process rather than assuming a file's hash captures everything.

Times also need context. A recorded transfer time should be understandable to another investigator, including the relevant time zone where necessary. Avoid silently converting or mixing times in ways that create a misleading sequence.

A small classroom exercise

Create an invented text file with no private information. Give it an evidence identifier, calculate its digest, and write a collection record. Make a controlled copy and record a fictional transfer. Then create a short extracted summary and label it as a derived output.

Ask another learner to follow the records. Can they tell which material was collected, which was copied, which was changed by analysis, and where each conclusion came from? A missing answer identifies a documentation gap.

Explain limits openly

Custody documentation supports traceability; it does not guarantee that the original collection captured every relevant artifact or that an interpretation is correct. If handling information is missing, describe the gap and its significance to the findings.

NIST SP 800-86 provides introductory forensic context. Apply current organizational procedures and obtain the appropriate specialist advice for formal proceedings. For learning, focus on reproducible handling and precise claims rather than assuming one universal form establishes every requirement.