Digital forensics and chain of custody

Chain of custody is the documented record of who held a piece of evidence, when, where it was stored and why it changed hands, from the moment it was found until it is used or destroyed. NIST’s glossary defines it as a process that tracks the movement of evidence through its collection, safeguarding and analysis lifecycle. The exam rule: evidence you cannot account for is evidence you may not be able to use, so on any forensic scenario the correct answer protects integrity first (collect in order of volatility, copy rather than touch the original, hash, document every transfer) and analysis comes later.

One laptop, followed from seizure to report

A finance employee is suspected of copying customer files to a USB drive. The following walk-through uses the four phases NIST SP 800-86 gives for forensics: collection, examination, analysis and reporting.

1. Collection. The laptop is still running. RFC 3227 says to collect from the most volatile data to the least volatile, and gives a typical order: registers and cache; routing table, ARP cache, process table, kernel statistics and memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; archival media. For this laptop that means capturing memory before anything is powered off, because a shutdown destroys it. Only then is the disk imaged.

2. Acquire without changing the original. NIST SP 800-86 describes a write-blocker as a hardware or software tool that prevents a computer from writing to the storage media connected to it. The analyst connects the disk through one, makes a bit-level copy (a copy of every bit, including deleted and unallocated space, not just visible files) and works from the copy. A snapshot of a virtual machine plays the same role for virtual systems. Memory dump, bit-level copy and snapshot are exactly the three “system image” examples in the Security+ objective list.

3. Prove integrity with a hash. The same NIST publication says integrity verification typically means computing a message digest of the original and of the copy and comparing them. A message digest is a hash with the property that changing a single bit gives a completely different value. If both hashes match, the copy is exact, and the hash is written into the record. See cryptography basics for why a one-way hash fits this job.

4. Document custody. RFC 3227 lists what the record must answer: where, when and by whom the evidence was discovered and collected; where, when and by whom it was handled or examined; who had custody and for what period, and how it was stored; and, when custody changed, when and how the transfer happened (including shipping numbers). A usable log looks like this:

A gap in this table (an hour nobody can explain, a transfer without a signature) is the weakness an opposing party would use.

5. Examination, analysis, reporting. Analysts work on copies, record what they did so another examiner could repeat it, and report findings without exaggeration. RFC 3227 also warns to record clock drift and to keep access to evidence extremely restricted.

Preservation, legal hold and e-discovery

These three words appear next to chain of custody in the Security+ outline and are easy to mix up.

• Preservation is keeping potentially relevant data unchanged, for example by imaging a disk or exporting logs before they roll over.
• Legal hold (listed under compliance in the outline) is a formal instruction to retain data that may be relevant to a legal matter, which suspends normal deletion and retention schedules. It is issued by legal, not by the security team.
• E-discovery is finding, collecting and producing electronically stored information for a legal matter. Microsoft Purview has a product by this name, covered in Purview eDiscovery.

The incident response phases around this work are in incident response lifecycle: investigation sits between identification and containment, and evidence gathering must not be delayed by cleanup. When the two conflict, a typical exam answer isolates the system (network isolation, not power-off) so containment happens while memory and disk stay intact.

Which exams test this

How exam questions are built around evidence

The classic question gives a compromised or suspect machine and asks for the first action. The trap is the instinct to clean up: reformatting, rebooting, “quickly looking through the files” or powering off to be safe. Each of those destroys volatile data or alters timestamps. Constraint words to look for: “admissible” or “legal proceedings” (custody and hashing matter), “most volatile” (memory and cache before disk), “original” (never analyse it, work from a verified copy), “integrity” (hash), and “who accessed” (the custody log). Also separate the documents: a custody form records people and transfers; a hash records the state of the data. One does not replace the other.

A second trap is mixing up legal hold with a backup or retention policy. Retention says how long data is kept normally; a legal hold overrides deletion for specific data. For the Microsoft side of retention, see retention labels vs policies.

Go deeper

• RFC 3227, Guidelines for Evidence Collection and Archiving, the order of volatility and the custody documentation list.
• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, the four phases, write-blockers and hash verification.
• NIST glossary: chain of custody, the formal definition.
• Related guides: common attack types, security frameworks (NIST and ISO), and how to study for certification exams.