19.3 Evidence Handling and Chain of Custody Ideas
Evidence Lives or Dies by Provenance
In a courtroom, a regulatory hearing, an insurance claim, or a disciplinary panel, a log line or a disk image is only as valuable as its paperwork. The chain of custody is an unbroken, signed record of who held each evidence item, when, where, and why — seizure, copy, analysis, storage — with a signature at every handoff. A single missing transfer entry and the opposing side's entire story becomes "anyone could have edited this," no matter how sound the bytes are. That logic starts before any lab work: preserve original logs at the source, and ship them to a central server that endpoints (and attackers with endpoint admin) cannot rewrite.
Write Blockers and Bit-Perfect Copies
Investigators never analyze the original drive. The standard workflow attaches the suspect disk through a hardware write blocker — an in-line device or forensic bridge whose electronics make writing physically impossible — then takes a bit-by-bit image covering allocated and unallocated space, as a raw dd image or an evidence format that embeds case metadata. Hashing is the proof step: compute a SHA-256 digest of the source before imaging and of the image after. A SHA-256 hash is 64 hex characters; if source and copy match, you have mathematical proof the copy is identical and untouched since seizure. A mismatch means the evidence is burned. All analysis happens on working copies; the original stays sealed.
Labels, Bags, and Handoff Forms
Every item gets a case-number label, and media go into tamper-evident bags that leave a visible mark when opened. Storage is a signed-out locker or a controlled evidence room, not a shelf under a desk. The custody form carries the item ID, its hash, and one row per transfer: from, to, date, time, purpose, both signatures. Retention follows the legal-hold and policy window, never convenience — destroying evidence early can look exactly like concealing it.
Architecture Diagram
Key Takeaways
- Chain of custody is an unbroken signed record of every person who touched each evidence item — one gap can burn the evidence.
- Hardware write blockers turn "we never modified the source" from a claim into a physical fact.
- Hash the source before imaging and the image after; a SHA-256 match proves bit-identical copies, a mismatch proves tampering.
- Analyze working copies only; the original stays sealed in tamper-evident packaging in a signed-out locker.
- Ship logs off-endpoint to a collector the attacker cannot rewrite, and retain everything per the legal-hold window.