Chain of custody for digital evidence: a practical checklist
A pristine forensic image is worthless if you cannot prove it wasn't tampered with. Here is the workflow we use on every engagement.
In court, evidence lives and dies by its chain of custody. The technical work is only half the battle; the documentation is the other half.
Acquire with hashes on both ends
Compute SHA-256 of the source before imaging, and of the resulting image immediately after. Record both in the case log; recompute at every handoff.
Write-blockers, always
Physical or software write-blockers on every acquisition. Log the make, model and firmware. A defense attorney will ask.
Timestamped, signed logs
Every action — mount, copy, analyze — logged with UTC timestamp, examiner ID and a rationale. Sign the log daily; store off-device.
Sealed transport
Tamper-evident bags with serialized seals. Chain-of-custody form signed by every hand the evidence passes through, no exceptions.