Evidence Handling

Order of volatility

RFC 3227 introduced the rule that has shaped forensic acquisition for two decades: collect evidence in order of how quickly it disappears. CPU registers vanish in microseconds; archive disks survive years. If you start with the slow stuff, the fast stuff is gone before you reach it.

The operational implication: the first decision in any host-side forensic acquisition is do not pull the power cord. The instinct is to "freeze" the machine; the effect is to destroy levels 1–5. Acquire RAM and network state first — with a known-good toolkit on bootable media — then power down for disk imaging.

Hash for integrity

Every piece of evidence gets a cryptographic hash recorded at the moment of collection. Anyone who later wants to verify "is this the same file we acquired?" runs the hash again and compares. If the hashes match, the evidence is unchanged.

• SHA-256 is the modern standard. MD5 still appears in legacy tooling and is acceptable for integrity (not for security), but pair it with SHA-256 for new work.
• Record both hashes in your documentation. Defense lawyers occasionally challenge MD5 alone in court because of known collisions; SHA-256 closes that door.
• Hash at acquisition. The hash on the original media should be recorded before the disk is moved or imaged again. The hash on the working copy proves the copy is faithful to the original.

Write blockers

Connecting a suspect's hard drive to your forensic workstation is risky: most operating systems will write to the drive automatically — mounting it, updating last-access timestamps, writing system metadata. Any write to the original evidence invalidates its integrity.

A write blocker sits between your workstation and the suspect drive. It allows reads to pass through; it intercepts and blocks writes. The drive appears to your forensic tools normally; the OS just can't modify it. Hardware write blockers (Tableau, WiebeTech, CRU) are the field standard because they don't depend on getting the OS configuration right.

Chain of custody

A chain of custody is the paper trail proving the evidence has been continuously accounted for from the moment of seizure to the moment of presentation. Every transfer between people, every storage location, every analysis activity is logged.

The form looks bureaucratic and is. Its purpose is defensive: if a defense attorney later argues "the evidence was tampered with between seizure and presentation," the chain of custody is what proves it wasn't — or, if there is a gap, what surfaces the gap honestly. The discipline matters for compliance audits and internal investigations even when no court is involved.

The forensic triad

Together, the practices above give you three properties that make evidence usable:

• Authenticity — we can prove the evidence is what we say it is (chain of custody + acquisition records).
• Integrity — we can prove the bytes haven't changed since acquisition (hashes + write blockers).
• Completeness — we acquired everything relevant, in the right order, without modification (order of volatility + thorough acquisition).

A piece of evidence that lacks any of these is a piece of information, not forensic evidence. It might still be useful for internal investigation; it will not survive scrutiny in a courtroom, by a regulator, or in a tabletop replay of how the response went.