Evidence Handling & Chain of Custody

Why Evidence Handling Is the Foundation of Everything

Digital forensics is not about running tools. Tools are the easy part. The hard part — the part that separates a forensic investigation from casual poking around — is evidence handling. Every action you take from the moment you touch a suspect system either preserves or destroys evidence. There is no neutral action.

Consider this scenario: a SOC analyst suspects a compromised web server. They SSH into the box, run ps aux to check running processes, open /var/log/auth.log in less, and copy a suspicious binary to their workstation using scp. In five minutes, they have:

• Modified the system's RAM (their SSH session, shell process, and every command they ran)
• Changed file access timestamps on every file they opened (atime updates)
• Created network connections that overwrote volatile network state
• Potentially triggered anti-forensic mechanisms planted by the attacker

They found useful information. But they also contaminated the evidence. If this case ever goes to court — or even to an internal disciplinary hearing — a competent opposing counsel will argue that the evidence cannot be trusted because it was modified before proper preservation.

The Order of Volatility

Not all evidence has the same lifespan. RAM contents change every millisecond. A hard drive can retain data for years. The order of volatility (defined in RFC 3227) ranks evidence sources from most volatile to least volatile, and it dictates the order in which you collect.

Click to enlarge

The rule is simple: collect the most volatile evidence first. If you start with a disk image (which takes hours), you will lose RAM contents, active network connections, and running process state. If you start with a RAM dump (which takes minutes), you preserve the volatile data and can image the disk afterward at your leisure.

Evidence Preservation Principles

Three principles govern every forensic evidence handling decision:

Principle 1: Do Not Modify the Original

The original evidence must remain unchanged. Every analysis should be performed on a forensic copy (image), never on the source media. If you must interact with a live system (to capture RAM, for example), document every command you run and the expected impact on system state.

Principle 2: Document Everything

If it is not documented, it did not happen. Forensic documentation must answer:

• Who collected the evidence (name, role, organization)
• What was collected (device, serial number, model, capacity)
• When it was collected (date, time, timezone — be precise)
• Where it was collected from (physical location, rack position, network segment)
• How it was collected (tool name, version, command used, write blocker model)
• Hash values at collection time (MD5 + SHA256 minimum)

Principle 3: Maintain the Chain of Custody

From the moment evidence is collected to the moment it is presented in court or a review board, every transfer must be documented. The chain of custody is a log that proves the evidence was not tampered with, lost, or mishandled at any point.

The Chain of Custody in Practice

A chain of custody form (physical or digital) records every person who handles the evidence and every location it passes through.

Click to enlarge

Every subsequent transfer gets a new row. If the hashes do not match at any transfer point, the chain is broken and the evidence may be considered compromised.

Write Blockers and Why They Exist

When you connect a hard drive to a computer, the operating system immediately begins modifying it — updating last-access timestamps, writing journal entries, mounting file systems. These modifications destroy evidence.

A write blocker is a hardware or software device that allows read access to a storage device while physically preventing any write operations. It sits between the evidence drive and your forensic workstation.

For forensic examinations that may result in legal proceedings, hardware write blockers are the standard. Software write blockers are acceptable for internal investigations where legal admissibility is not a primary concern.

Triage vs. Full Imaging: The Decision

Not every incident requires a full forensic image of every drive. The decision depends on the situation:

Evidence Handling Procedures: Step by Step

A disciplined evidence handling workflow follows this sequence:

Step 1: Isolate the system. Disconnect from the network (pull the cable, disable Wi-Fi) to prevent remote wiping or continued attacker access. Do not power off — you will lose volatile data.

Step 2: Document the scene. Photograph the screen, note any running applications visible, record the system time (compare to a reference clock for skew), document all connected peripherals and cables.

Step 3: Capture volatile data. Memory dump first (WinPMem on Windows, LiME on Linux). Then capture running processes, network connections, logged-in users, open files, and clipboard contents.

Step 4: Triage collection (if time-critical). Run KAPE or Velociraptor collection to grab critical artifacts while you set up for full imaging.

Step 5: Full disk image. Connect write blocker, attach evidence drive, create a bit-for-bit image using FTK Imager or dd/dcfldd. Hash the image immediately.

Step 6: Verify hashes. Compute MD5 and SHA256 of the image and compare to the source. They must match.

Step 7: Secure original evidence. Place the original drive in an anti-static bag, seal it, label it with the case ID and evidence ID, and store it in a locked evidence locker.

Step 8: Work on the copy. All analysis happens on the forensic image, never the original.

Legal Considerations

Evidence handling is ultimately about admissibility. If your investigation results in a termination, a lawsuit, or a criminal referral, the evidence must meet legal standards.

Common Mistakes That Destroy Evidence

Key Takeaways

• The order of volatility (RFC 3227) dictates collection order: RAM and processes first, disk last — because volatile evidence disappears fastest
• Chain of custody documents every person, every transfer, and every hash verification from collection to courtroom — if a link is missing, the chain is broken
• Write blockers prevent the operating system from modifying evidence media during imaging — hardware blockers are the forensic standard
• Triage collection (KAPE, Velociraptor) grabs critical artifacts in minutes; full imaging (FTK, dd) preserves everything including deleted data but takes hours
• Hash verification (MD5 + SHA256) at collection and every transfer proves evidence integrity — a single-bit discrepancy means contamination
• The first responder's paradox means every action modifies the system — minimize your footprint by using remote tools and documenting every command
• Treat every investigation as potentially going to court: follow forensic standards even for internal incidents

What's Next

Now that you understand how to handle and preserve evidence, Lesson 9.2 covers Disk Imaging & Acquisition — the tools and techniques for creating forensically sound copies. You will learn FTK Imager, dd/dcfldd, KAPE triage imaging, and remote acquisition via Velociraptor, along with when to use each method and how to verify your images.