Chain of Custody — Documentation, Evidence Handling, and Defensibility

A technically perfect forensic acquisition can be destroyed by a broken chain of custody. Courts have excluded evidence where the analyst could not explain who had access to the evidence between collection and analysis — not because the evidence was tampered with, but because it could not be proven that it wasn’t.

The Chain of Custody Form

Every evidence item requires its own chain of custody record:

═══════════════════════════════════════════════════════════════
DIGITAL EVIDENCE CHAIN OF CUSTODY
Case Number: IR-2024-089
Evidence Item #: E001
═══════════════════════════════════════════════════════════════

EVIDENCE DESCRIPTION
Description:    Physical memory image from WS-JSMITH-01
                RAM: 16 GB, Windows 10 Pro 22H2
System details: Hostname: WS-JSMITH-01
                IP: 10.1.2.33
                Serial: [system serial number or asset tag]

COLLECTION DETAILS
Collected by:   M. Torres, Senior IR Analyst, DFIR Corp
Date/Time UTC:  2024-09-02T18:30:00Z
Location:       Finance Department, Floor 3, Room 304
Tool:           WinPmem v4.0.rc1
Tool SHA256:    [hash of WinPmem binary — proves tool integrity]

EVIDENCE ITEM DETAILS
Filename:       WS-JSMITH-01_memory_20240902T1830.raw
File size:      16,384,001,024 bytes
MD5:            9b4c2f1d3e8a7b6c5d4e3f2a1b0c9d8e
SHA256:         4a3f7e2c8b1d5e9f3c7a2e6b4d8f1a5c...
Acquisition start: 2024-09-02T18:30:00Z
Acquisition end:   2024-09-02T18:48:42Z
Verification:   Hash verified at acquisition completion ✓

═══════════════════════════════════════════════════════════════
CHAIN OF CUSTODY LOG
═══════════════════════════════════════════════════════════════

Entry 1:
Date/Time UTC:  2024-09-02T18:49:00Z
Released by:    M. Torres (signature)
Received by:    [Evidence custodian — forensic server admin]
Method:         Copied to \\forensic-server\IR-2024-089\E001\
Location:       Network-attached storage, Access-controlled
Purpose:        Storage as forensic master copy

Entry 2:
Date/Time UTC:  2024-09-02T19:15:00Z
Released by:    [Evidence custodian] (signature)
Received by:    M. Torres (signature)
Method:         Working copy created from E001
               Working copy hash verified against E001 ✓
               Analysis performed on working copy only
Location:       Forensic analysis workstation (isolated)
Purpose:        Memory analysis (Volatility 3)

Entry 3:
Date/Time UTC:  2024-09-02T23:00:00Z
Released by:    M. Torres (signature)
Received by:    [Evidence custodian] (signature)
Method:         Analysis complete; working copy archived
Location:       Forensic server — case archive
Purpose:        Storage pending case closure

═══════════════════════════════════════════════════════════════
DISPOSITION
Final status:   Preserved — case open (IR-2024-089)
Destruction date: [TBD — per retention policy]
═══════════════════════════════════════════════════════════════

Evidence Labeling Standards

Every physical or digital container of evidence must be labeled:

Physical label (on USB/external drive):
┌─────────────────────────────────────────┐
│ EVIDENCE — DO NOT MODIFY                │
│ Case: IR-2024-089   Item: E001          │
│ Description: WS-JSMITH-01 Memory Image  │
│ Collected: 2024-09-02 UTC               │
│ Analyst: M. Torres                      │
│ Hash: 9b4c2f1d... (MD5 — see COC form) │
└─────────────────────────────────────────┘

Digital file naming convention:
[hostname]_[artifact]_[YYYYMMDD]T[HHmm].[ext]
Example: WS-JSMITH-01_memory_20240902T1830.raw
         WS-JSMITH-01_disk_20240902T2100.E01
         WS-JSMITH-01_netstat_20240902T1825.txt

Common Chain of Custody Failures

Failure	Consequence	Prevention
No hash computed at acquisition	Cannot prove evidence wasn’t modified later	Hash immediately after acquisition, before first copy
Analyst analyzed the forensic master copy	Any modification destroys the master	Always work on working copies
Gap in custody log (no transfer record)	Evidence may have been accessed/modified during gap	Document every transfer, including temporary storage
UTC not used (local time without timezone)	Timestamps ambiguous across jurisdictions	Always use UTC; document timezone if local time used
Tool version not documented	Cannot reproduce acquisition or challenge tool validity	Document tool name, version, and hash
Evidence accessible without access control	Third parties could access or modify	Store in locked cabinet or access-controlled share
Hash computed after network transfer	Network errors could modify data before hash	Hash at source, before transfer, then verify at destination

Retrieval Practice

An IR analyst collected a memory image and disk image from a compromised server. The analyst put both images on a USB drive, drove home, and analyzed them on their personal laptop overnight. The next morning, they transferred the images to the forensic server. What chain of custody failures occurred?

Reveal answer

Multiple chain of custody failures: (1) No access control during transit — the evidence was on a personal USB drive in the analyst's vehicle and home, accessible without documented access controls. (2) Personal laptop is not a controlled forensic environment — personal systems may have antivirus (which reads every file), cloud backup (which uploads evidence), other users with access, or uncontrolled software. Any of these could modify or access the evidence. (3) Missing custody log entries — there is no record of who had access to the evidence between collection and the forensic server. (4) Network transfer without hash verification — when files were copied from USB to forensic server, was the destination hash verified against the acquisition hash? If not, transfer errors could go undetected. Prevention: (a) Copy evidence directly to secured forensic server at collection time (network transfer with immediate hash verification). (b) If USB transport is necessary: use encrypted, access-controlled USB; document the chain of custody including transit. (c) Never analyze evidence on personal equipment.