Digital Forensics and Chain of Custody

A crime scene, but digital

Digital forensics applies the same discipline to computers, phones, cloud accounts and logs: identifying, collecting, preserving, analysing and presenting digital evidence so it’s acceptable in legal or disciplinary proceedings. Assume everything will be challenged, and work so it survives.

The process

1. Identification: what evidence exists, and where (laptops, servers, cloud, logs, phones).
2. Preservation: secure the scene, prevent changes, isolate devices from networks, capture volatile data.
3. Acquisition: make a forensic image, a bit-by-bit copy, using a write blocker so the original can’t be changed. Calculate hashes of the original and the image to prove they’re identical.
4. Analysis: examine the copy, never the original. Rebuild a timeline, recover deleted files, examine logs.
5. Documentation: record every step, tool and finding, so another examiner could repeat the work.
6. Presentation: a clear, objective report for management, lawyers or the court.

Switching on a seized device, or opening files on it, changes the evidence. Hashes prove the copy is unchanged; they don’t encrypt anything.

Most fragile first

Some evidence vanishes in seconds. Collect it in order of volatility, the most fragile first:

1. CPU registers and cache
2. Memory (RAM): running processes, encryption keys, network connections
3. Network state and running processes
4. Temporary and swap files
5. Disk contents
6. Remote logs and monitoring data
7. Archives and backups

Pulling the plug wipes memory. Whether to power down, capture memory first, or keep the system running is a call for trained responders.

Chain of custody

The chain of custody is the documented record of everyone who handled the evidence, from collection to court:

• a unique ID for each item
• who collected it, when and where
• every hand-over, with signatures and times
• secure, access-controlled storage
• hash values recorded and re-checked

Any gap lets the other side argue the evidence could have been altered, which can make it inadmissible.

Example. An internal investigator copies files from a suspect’s laptop by dragging them onto a USB stick, then opens them to have a look. File access times change, there’s no hash, and there’s no custody record. When the case reaches an employment tribunal, the evidence is challenged and excluded.

The auditor’s role

• Evidence must be collected lawfully, respecting privacy laws and employee rights, so involve legal counsel early.
• Use qualified examiners and validated tools, following documented procedures such as ISO/IEC 27037.
• The IS auditor’s job is to recognise when forensics is needed, avoid damaging evidence, and bring in specialists, not to have a go untrained.
• Cloud and mobile evidence add challenges: where the data is, whether the provider will cooperate, and encryption.

How the exam asks about it

In short

• Digital forensics identifies, preserves, analyses and presents digital evidence in a way that is legally acceptable.
• Evidence is collected in order of volatility: CPU registers and cache, memory, network state and running processes, then disk, then logs and archives.
• A forensic image (bit-by-bit copy) is made with a write blocker, and its hash is compared with the original to prove it's identical.
• Analysis is performed on a copy, never the original evidence.
• Chain of custody documents who collected, handled, transferred and stored the evidence, and when.
• Evidence must be collected lawfully, by qualified people, following documented procedures, to be admissible.

Exam traps

• Memory evidence is lost on shutdown, so it's collected first.
• Turning on a seized device or opening files on it changes evidence.
• Any gap in chain of custody can make evidence inadmissible.
• The IS auditor's role is to recognise when forensics is needed and involve specialists, not to perform it untrained.
• Hashes prove integrity of the copy; they don't encrypt it.

Slides

Click the slide and use the arrow keys. F toggles full screen.