Digital evidence and the chain of custody

Why handling matters

Each time a computer starts up or a phone receives a notification, data on it changes. Timestamps are updated, logs grow, and storage that once held removed files can be reused. None of this is visible to the user, yet it can blur or erase the very records an investigation depends on. Careful handling from the first moment keeps a device as close as possible to the state it was in when the question arose.

Keeping that record matters because a gap in it invites an awkward question later, namely whether the evidence could have been altered.

What should I do before the device reaches an examiner?

• Leave it in its current state. If it is on, do not switch it off unless it is at risk of damage or remote wiping; if it is off, leave it off.
• Do not browse it, open files, read messages or “just check” anything. Every action leaves traces and can write over older data.
• Do not install apps, run a virus scan, plug it into another computer or let anyone guess at the passcode.
• Keep it safe: dry, cool and secure, together with its charger, cables, case and any memory cards.
• Write down who has handled it, when and what they did, starting from the moment it was found or collected.
• If you know the passcode and are entitled to share it, give it to the examiner directly rather than taping it to the device.

If a computer is still running and may be part of an active intrusion, get advice before turning it off. Anything held only in its memory disappears when the power goes.

Imaging and hardware write-blocking

Examiners avoid working on the original wherever they can. Instead they make a forensic image: a complete, bit-for-bit copy of the storage, including apparently empty areas where traces of removed files may survive.

To make that copy without changing anything, the drive is connected through a hardware write-blocker. This lets data be read from the drive but refuses any instruction that would write to it. The original is then sealed and stored, and the analysis is carried out on the copy. We use hardware write-blocking when imaging storage media, and record a hash value for each exhibit.

Phones are handled differently. Their storage usually cannot be removed and attached to a write-blocker, so examiners use physical or logical extraction, depending on what the handset allows, and document each step.

What does a hash value show?

A hash value is a short string of characters calculated from the contents of a file or a whole drive. Change a single bit of the data and the value changes completely; run the same calculation on the same data and you get the same value every time. It works like a fingerprint for data, without revealing the data itself.

Examiners calculate a hash when the image is made and again whenever they need to confirm nothing has moved. A matching value shows:

• that the copy is identical to the data it was taken from;
• that the copy has not changed between the two calculations.

A matching value does not show:

• who created, sent or opened the files;
• whether what the files say is true, or when the events in them happened;
• that the device was handled properly before it was imaged. That is the job of the custody record.

What goes into a custody record?

• a description of the exhibit, its serial number if it has one, and photographs of its condition;
• every handover, with the date, time and the names and signatures of the person giving and the person receiving it;
• where the exhibit was stored between handovers and how it was sealed;
• the hash values recorded when it was imaged;
• anything done to the device, by whom and for what reason.

We log each exhibit on a chain-of-custody record at intake and photograph it before work begins. If the findings are later used in proceedings, the record lets the court follow the exhibit from collection to report. Whether evidence is admitted is decided by the court in each case.

Terms in this guide

• Chain of custody
• Forensic image
• Write-blocker
• Hash value
• Logical extraction

Questions