Chain of custody

Chain of custody is the documented record of who has had the evidence, when, where, and what they did with it, from collection to trial. Without it, the best technical evidence can be inadmissible: a broken chain allows claims of tampering.

Principles of digital evidence

Integrity       the evidence hasn't changed since collection (hashes)
Authenticity    it is what it's claimed to be, from where it's claimed
Traceability    every handling is recorded (who/when/why)
Repeatability   another examiner, with the same data and method, reaches the same result
Legality        collected with proper authorization/warrant

The process

1. IDENTIFY    what is evidence and its order of volatility (RAM before disk)
2. COLLECT     with a write-blocker; hash (SHA-256) at the moment of acquisition
3. LABEL       unique identifier, description, date/time, responsible person
4. TRANSFER    every change of hands signed (from whom to whom, when, why)
5. STORE       safely, controlled access; the original intact
6. ANALYZE     ON COPIES; re-verify hash before and after
7. DOCUMENT    reproducible report with methods and tools (versions)

Hashing and verification

- hash the image on acquisition and each time it's accessed -> prove it didn't change
sha256sum image.dd    # same on acquisition as on analysis = integrity demonstrated
# any hash discrepancy invalidates integrity -> explain the cause

Order of volatility (RFC 3227)

1. CPU registers/cache, routing table, ARP, processes
2. RAM (dfir-memoria)
3. network state/temporary connections
4. disk (dfir-disco)
5. remote logs, backups
6. physical configuration, topology
-> capture from MOST volatile to least

Mistakes that break the chain

- analyzing on the original (not a copy) -> contamination
- not hashing or not documenting transfers -> can't prove integrity
- storage without access control -> tampering claim
- undocumented tools/versions -> not reproducible

Blue Team / DFIR and legal

Prepare chain-of-custody templates and procedures BEFORE the incident (part of the IR plan, Incident response).
Train the team: containment must not destroy evidence (see Incident response).
Coordinate with legal/GDPR (GDPR & privacy): evidence may contain personal data and be used in proceedings.
In cloud/ephemeral (containers), define how to preserve before the resource disappears.

Real-world cases

Many court cases decided (or lost) on the strength of the chain of custody and hashing.
In corporate DFIR, a clean chain is what enables later legal/HR action.
Cloud/container environments force adapting the concept (snapshots, export with metadata).

Testing checklist

Custody templates and procedure ready (pre-incident)
Order of volatility respected (RAM before disk)
Hash on acquisition and re-verified on analysis
Unique labeling and a signed record of each transfer
Original intact; analysis only on copies
Storage with access control
Tools/versions and method documented (reproducible)
Legal/GDPR coordination