# Evidence Handling and Chain of Custody

> Chapter 3 of the Courseiva EC-CHFI curriculum — https://courseiva.com/learn/ec-chfi/evidence-handling-and-chain-of-custody

**Official objective:** 2.1 — Explain proper evidence collection, preservation, and chain of custody procedures.

## Introduction

Exam objective 2.1 demands that you understand proper evidence collection, preservation, and chain of custody procedures. This concept solves the single biggest problem in digital forensics: proving that evidence examined in a lab today is exactly the same as what was collected at a crime scene last week. Without this, any evidence can be successfully challenged in court, no matter how damning it actually is.

## The Crime Scene Evidence Technician Analogy

Meet Sarah, a crime scene evidence technician. Her job is to process a burglary scene inside an electronics shop. She arrives and immediately takes photos of the entire scene from every angle before anyone touches anything. She puts on gloves to avoid leaving fingerprints and uses tweezers to pick up a single fibre from the carpet. She places that fibre into a clean, labelled paper bag, seals it with tamper-evident tape, and writes her initials, the date, and the case number across the seal. She logs every single item she collects in a bound notebook, noting the exact time, location within the room, and a description. When she hands the bag to the forensic lab courier, the courier signs for it, and Sarah updates her log with the courier's name and the handover time. The lab receives the bag, checks the seal is intact, signs again, and writes the storage locker number and temperature. If the defence lawyer later asks 'Was that fibre swapped, contaminated, or left on a shelf for a week?', Sarah can pull out her notebook and prove, step by step, exactly who had it, when, and under what conditions. Every movement is tracked, every signature is witness-able, and the evidence chain is unbroken.

This is precisely how a digital forensic investigator handles a seized laptop, USB drive, or hard disk. The physical world of evidence handling—gloves, logs, seals, signatures—has a direct, technical counterpart in the digital forensic world. The same obsession with demonstrable, documented control applies. When a prosecutor (or a judge) asks 'Was this digital evidence tampered with?', the forensic examiner must produce the exact same kind of unbroken documentation Sarah creates. The name for this documentation is the chain of custody.

## Core explanation

Digital forensic evidence handling and chain of custody are the twin pillars that make evidence legally admissible in court. In the real world, when a police officer collects a gun from a crime scene, they do not simply throw it in the boot of their car. They photograph it, bag it, label it, seal it, log it, and hand it to a property clerk who signs for it. Every single transfer between people or locations is recorded. The digital world works exactly the same way, but with a few extra complications.

At its simplest, chain of custody is a written record that tracks every person who handled a piece of evidence from the moment it was first collected until the moment it is presented in court. The record must show the date, time, unique identifier for the evidence, description of the evidence, the name of the person handing it over, the name of the person receiving it, and the purpose of the transfer. A break in this chain—even a missing signature or an unaccounted-for hour—can make the evidence inadmissible.

Evidence collection itself splits into two broad categories: physical evidence and digital evidence. Physical evidence includes items like seized hard drives, USB sticks, laptops, mobile phones, and printed documents. Digital evidence is the data stored inside those devices: files, emails, browser history, deleted fragments, and system logs. Both types need handling procedures, but digital evidence has specific technical requirements.

The first principle is preservation. When a device is seized, it must be powered down or placed into a state that prevents any data from being written or changed. Why? Because simply turning a laptop on can overwrite deleted data, modify file timestamps, and create new temporary files. That is considered contamination. The forensic investigator uses a write blocker—a hardware device or software tool that lets them examine the drive without accidentally writing anything to it. Think of a write blocker like a bookcase with a glass front: you can see all the books, but you cannot pull one out or put a new one in.

The second principle is collection. The investigator makes a forensic image (a bit-for-bit copy) of the original drive. They do not work on the original drive directly. The image is an exact duplicate, including empty space and deleted files. They then use a cryptographic hash, usually SHA-1 or SHA-256, to generate a digital fingerprint of the original drive and another fingerprint of the image. If the two fingerprints match, the image is an identical copy. Any subsequent analysis is performed on the image, not on the original.

The third principle is documentation. Every action the investigator takes must be logged: the time they started the imaging, the tool they used, the hash values produced, the name of the technician, the case number, and the storage location of the image. This log is often called the forensic examiner's notes or case notes.

The fourth principle is storage. The original device and the forensic image must be stored in a secure, locked facility with restricted access. The storage area should have environmental controls (temperature and humidity) to prevent physical degradation. Only authorised personnel should have keys or access cards. Every time someone enters or leaves, it should be logged.

The fifth principle is transportation. If evidence moves from one location to another—say, from the police station to a private forensic lab—it must be sealed in a tamper-evident bag with a unique seal number. The bag must be transported by a courier who signs a chain of custody form. The receiving lab checks the seal is intact, signs the form, and logs the condition of the bag.

When we talk about chain of custody in the context of the 312-49 exam, we are talking about a formalised process that includes:

- Evidence tags or labels that are affixed to each item at the time of collection.
- A chain of custody form (sometimes called an evidence custody form or property custody sheet).
- A secure evidence locker or evidence room with access logs.
- A documented audit trail of every examination, transfer, and return.

The entire process replaces the informal, unverified practices that used to be common. Before proper chain of custody became standard, investigators sometimes took evidence home, left it on a desk, or lent it to a colleague without any record. That meant a defence lawyer could always argue the evidence could have been swapped, altered, or planted. The chain of custody makes those arguments much harder to sustain.

Why does this matter for someone studying for 312-49? Because the exam will test you on exactly these procedures. You need to know what a write blocker does, what a forensic image is, why hashing matters, and what information must be in a chain of custody form. You also need to know what happens if the chain is broken: the evidence will be excluded from court, and the entire investigation can collapse.

## Real-world context

An IT professional working in digital forensics, often called a forensic examiner, uses these principles every day. Consider a real scenario: a medium-sized company suspects an employee of stealing customer data. The employee has a company-issued laptop and a personal USB drive. The IT department, under the direction of legal counsel, decides to seize both items for forensic analysis.

Step one: Preparation. Before touching anything, the forensic examiner ensures they have the right legal authorisation—usually a search warrant or a signed consent form from the company's HR department. Without that, the evidence is inadmissible from the start.

Step two: Collection at the scene. The examiner approaches the employee's desk with a witness (usually a manager or a security officer). They take a photograph of the desk showing the laptop, USB drive, and any visible cables before moving anything. They label the cables and ports with stickers or tags. They then safely power down the laptop by holding the power button (not using the operating system's shutdown command, because that could alter data). They disconnect the laptop from any network cables and remove the battery if possible. They place the laptop in an anti-static bag and then into a rigid cardboard box. They label the bag with a case number, date, time, examiner's initials, and a description. The USB drive goes into its own small anti-static bag, similarly labelled. The examiner then completes the initial chain of custody form, noting the location, the person from whom the items were seized, and the start time of the seizure.

Step three: Transportation and storage. The examiner drives the boxed evidence directly to the forensic lab. They do not stop for coffee, leave it in the car, or hand it to anyone else. At the lab, they log the evidence into the secure evidence locker, record the locker number and a timestamp, and then lock the locker. The chain of custody form now shows the transfer from the scene to the locker.

Step four: Forensic imaging. The examiner retrieves the laptop from the locker, signs it out, and brings it to the forensic workstation. They connect the hard drive to a write blocker and create a forensic image using a tool like FTK Imager or EnCase. They run a SHA-256 hash on the original drive and on the image. If the hashes match, they know the image is perfect. They then store the image on a secure network drive or an external storage device that is also kept in the evidence locker. The original drive is returned to the locker. The chain of custody is updated with the imaging start and end times, the tool used, the hash values, and the signature of any person who witnessed the process.

Step five: Analysis and reporting. The examiner analyses the forensic image, looking for deleted files, unusual network connections, and any evidence of data theft. They take screenshots of findings and document every step. They produce a final report that summarises the findings and includes the full chain of custody. That report becomes part of the court evidence.

Throughout this entire process, the examiner is constantly updating the chain of custody. Every time the evidence moves—from the locker to the workstation, from the workstation to the examiner's desk, back to the locker—it must be logged. The key rule is: if you touch it, you document it. The examiner also ensures that only authorised people have access to the evidence locker and that the locker itself has a camera or access card log.

In a real-world trial, the defence attorney will ask the examiner: 'How do we know this image you analysed is the same as the drive you seized?' The answer is the chain of custody plus the hash values. The examiner can produce the initial chain of custody showing who seized the drive, when, and where. They can produce the subsequent chain of custody showing the drive went from the locker to the imaging station and back. They can produce the hash comparison showing the image matches the original. That is how admissibility is established.

## Exam focus

The 312-49 exam tests evidence handling and chain of custody from both a theoretical and a procedural angle. You need to be ready for multiple-choice questions that ask you to identify the correct sequence of steps, the right tool for a task, or the exact information required on a chain of custody form.

Here are the specific concepts the exam loves to test:

- Chain of custody form contents. The exam will list items and ask which ones are required on a chain of custody form. The mandatory items include: unique evidence identifier, description of evidence, date and time of collection, name of person collecting, name of person receiving, signature of both parties, purpose of transfer. Traps often include optional items like weight of the evidence or serial numbers of the collecting officer's car. Memorise the mandatory list.

- Write blockers. The exam will test the purpose of a write blocker: it prevents data modification during imaging. A common question presents a scenario where an investigator connects a drive directly to a forensic workstation without a write blocker. The correct answer is that data could be altered, making the evidence inadmissible. Memorise that the only exception is when examining a device that must remain powered on (like a running server), where different procedures apply.

- Forensic imaging vs. regular copying. A regular copy (Windows copy/paste) does not capture deleted files, metadata, or unallocated space. A forensic image captures every single bit, including empty space. The exam will ask which method represents best practice. The answer is forensic imaging.

- Hashing algorithms. The exam expects you to know that SHA-1 and SHA-256 are common for forensic hashing. They might ask about MD5, which is older and weaker but still sometimes used. The key point is that hashing verifies integrity: if the hash of the original device matches the hash of the image, the data is intact. The exam loves to test the concept of hash collision (two different files producing the same hash). Collisions are extremely rare with SHA-256, but theoretically possible.

- Tamper-evident packaging. Seals, bags with unique numbers, and initialling across the seal are all required. The exam will ask what to do if the seal is broken when evidence arrives at the lab. The correct answer is to document the breakage, contact the sender, and possibly reject the evidence if the chain cannot be validated.

- Order of volatility. This is a closely related concept. When collecting digital evidence from a live system, you must collect the most volatile (easily lost) data first. The order is: registers and cache, routing tables, ARP cache, process table, kernel statistics, memory, temporary file systems, disk. The exam will test this sequence.

- Evidence access logs. Every time evidence is accessed, the log must show who accessed it, when, and why. The exam may ask who is allowed to access evidence. The answer is only authorised personnel with a legitimate investigative need.

- Common traps. The exam often sets up a question where an investigator transports evidence in a plastic bag instead of an anti-static bag. The correct answer is that static electricity can damage the device. They also set traps about handling: an investigator who picks up a drive with bare hands has contaminated it with fingerprints. The examiner must wear gloves.

- Documentation. The exam will ask about the difference between notes and formal reports. Notes are contemporaneous (written at the time of the action). Reports are written later and synthesise the notes. Both are discoverable in court.

- Exceptions. The exam acknowledges that perfect chain of custody is not always possible, for example with cloud-based evidence. In those cases, you document the steps you took to preserve integrity and explain why the ideal process was not possible.

To pass this section, focus on memorising the mandatory elements of a chain of custody form, the purpose and correct use of write blockers, the difference between forensic imaging and logical copying, and the order of volatility. Those are the highest-yield topics.

## Step by step

1. **Seize and Secure the Scene** — Before touching any device, photograph the scene from multiple angles. Note the exact position of every piece of equipment, including cables and peripherals. Secure the area to prevent unauthorised access. This step creates a baseline record that prevents accusations of tampering or planting.
2. **Power Down or Isolate the Device** — For most devices, safely power them down by holding the power button (do not use the operating system shutdown command). For running servers, you may need to capture live data first (memory, network connections) before powering down. This step prevents accidental data alteration or overwriting.
3. **Label, Bag, and Tag All Evidence** — Place each item in an anti-static bag or box, apply a tamper-evident seal, and write a unique evidence identifier, date, time, and your initials across the seal. Attach an evidence tag with detailed description (make, model, serial number, condition). This creates a physical link between the item and the chain of custody form.
4. **Complete the Initial Chain of Custody Form** — Fill out the first entries on the chain of custody form: evidence identifier, description, location of seizure, person from whom seized, date and time, your name and signature, and any witnesses. This is the starting point of the legal trail.
5. **Transport Evidence to Secure Storage** — Transport all evidence directly to a secure, locked evidence locker or lab. Use a tamper-evident bag or box. Document the transport route and mode. Upon arrival, log the evidence into the locker, record the locker number, and have the receiving person sign the chain of custody form. This proves the evidence was never left unattended.
6. **Create Forensic Images with Write Blocker** — Remove the original evidence from storage, sign it out, and connect it to a forensic workstation using a write blocker. Use approved imaging software to create a bit-for-bit copy. Generate a SHA-256 hash of both the original and the image. If they match, lock the original back in storage and store the image on a secure network drive. Update the chain of custody with imaging start/end times and hash values.
7. **Analyse the Image and Document Findings** — Work exclusively with the forensic image, not the original device. Use forensic tools to search for relevant files, deleted data, metadata, and system logs. Take screenshots, record timestamps, and write contemporaneous notes. Every finding must be traceable back to the image. Document the analysis steps in a formal report that references the chain of custody and hash values.

## Comparisons

### Forensic Image vs Logical Copy (e.g., Windows Copy)

**Forensic Image:**
- Captures every bit on the drive including deleted files, file slack, and unallocated space
- Creates a single file (image file) that can be verified with cryptographic hash
- Required for legal admissibility in most jurisdictions

**Logical Copy (e.g., Windows Copy):**
- Only copies visible files and folders
- Does not capture deleted data, metadata, or unallocated space
- Not suitable for forensic analysis; can be challenged in court as incomplete

### Hardware Write Blocker vs Software Write Blocker

**Hardware Write Blocker:**
- A physical device that sits between the suspect drive and the forensic workstation
- Works at the hardware level, blocking all write commands before they reach the drive
- More reliable and trusted in court because it does not rely on the operating system

**Software Write Blocker:**
- A software driver that intercepts write commands at the OS level
- Can be bypassed by certain low-level writes or drive firmware quirks
- Less trusted because it depends on the integrity of the forensic workstation's OS

### Chain of Custody Form vs Examiner's Notes

**Chain of Custody Form:**
- A formal, standardised document tracking every transfer of evidence between people and locations
- Contains mandatory fields: evidence ID, date, time, signatures of both parties, purpose
- Is a legal document that must be preserved for the entire lifecycle of the case

**Examiner's Notes:**
- Informal, contemporaneous notes recorded by the examiner during analysis
- May include subjective observations, diagrams, and step-by-step actions
- Used internally to support the final report, not typically submitted as a standalone legal document

### Tamper-Evident Seal vs Tamper-Proof Seal

**Tamper-Evident Seal:**
- Shows clear evidence if someone has opened the bag or container (e.g., a seal that says 'VOID' when removed)
- Does not prevent access; it only makes intrusion visible
- Standard for most forensic evidence packaging

**Tamper-Proof Seal:**
- Theoretically prevents any access without special tools (e.g., a hardened lock)
- Very rare in forensic context because it is impractical and unnecessary
- Not used because the goal is detection of tampering, not absolute prevention

## Diagram

_Flowchart outlining the step-by-step process from device seizure to evidence analysis, showing where chain of custody is updated at each stage._

```mermaid
flowchart TD
    A[Seize Device] --> B[Photograph & Label]
    B --> C[Place in Anti-static Bag with Seal]
    C --> D[Complete Initial Chain of Custody Form]
    D --> E[Transport to Secure Storage]
    E --> F[Log into Evidence Locker]
    F --> G[Retrieve for Imaging with Write Blocker]
    G --> H[Create Forensic Image]
    H --> I[Hash Original & Image]
    I --> J{Hash Match?}
    J -->|Yes| K[Store Original Back in Locker]
    J -->|No| L[Investigate Discrepancy / Re-image]
    K --> M[Analyse Image on Forensic Workstation]
    M --> N[Document Findings in Report]
    N --> O[Chain of Custody Complete]
    L --> G
```

## Common misconceptions

- **Misconception:** Chain of custody is just a piece of paper that you fill out once and file away. It is not that important because the evidence is digital and can be verified later. **Reality:** Chain of custody is a continuous, real-time log that must be updated every time evidence changes hands. Without it, even a perfect forensic image can be excluded from court. The chain is the legal proof that the evidence has not been tampered with. (Beginners often think the technical work (hashing, imaging) is all that matters for admissibility. They do not realise that the law cares as much about the process around the evidence as about the evidence itself. The chain of custody is how you prove that process.)
- **Misconception:** If you use a write blocker, you do not need to document the time you started collecting the evidence because the write blocker guarantees no contamination. **Reality:** A write blocker prevents data modification, but it does not prove that you used it correctly or that you did not skip other steps. Documentation of the entire process, including start and end times, is mandatory regardless of the tool used. (Newcomers tend to equate 'tool use' with 'process compliance'. They think using a write blocker automatically makes the evidence sound. Actually, the tool is only one part of the process. The court needs to see the full sequence of actions, not just that a tool was present.)
- **Misconception:** You can take a forensic image using a Windows copy command as long as you verify it with a hash afterwards. **Reality:** A Windows copy (or any logical copy) does not capture unallocated space, file slack, or deleted files. A forensic imaging tool must be used to capture the entire bit-for-bit representation of the drive. Hashing a logical copy only proves the copy of the files is correct, not that you have captured everything on the drive. (The term 'image' is misleading in everyday language. Many beginners think a folder full of copied files is an 'image' because they have heard the word used loosely. Forensic imaging has a strict definition: it must include all sectors of the source device.)
- **Misconception:** If the original device is damaged and cannot be imaged, you simply work on the device directly and note the damage in your report. **Reality:** You must first attempt to repair the device using approved hardware tools (like a disk imager designed for damaged drives) to create a forensic image. Working directly on the original device is the absolute last resort and requires extensive documentation. Even then, you should try to image before doing any analysis on the original. (Beginners often assume that a broken drive means you can just skip imaging and work directly on it. That is a dangerous assumption because it introduces risk of further damage. Proper procedure always attempts to preserve the original through imaging first.)
- **Misconception:** When evidence is sent to a third-party lab, the lab does not need to sign the chain of custody because they are professionals and their internal logs are sufficient. **Reality:** Every third-party lab must sign the chain of custody form from the originating organisation. Internal logs are not a substitute for a signed transfer between parties. The chain must show the handover from the original custodian to the lab, and from the lab back to the original custodian. (This misconception arises from trust in professional labs. The chain of custody is about legal admissibility, not professional trust. The court needs a formal, signed record of every single transfer, regardless of how reputable the receiving party is.)

## Key takeaways

- Chain of custody is the legal trail that proves evidence has not been tampered with from the moment of collection to courtroom presentation.
- A forensic image is a bit-for-bit copy of a storage device, including all deleted files and empty space, created using specialised tools like FTK Imager or EnCase.
- A write blocker is a hardware or software device that prevents any data from being written to the original evidence during examination.
- Cryptographic hashing (SHA-1 or SHA-256) verifies the integrity of a forensic image by comparing its hash to the hash of the original device.
- Every person who handles evidence must sign the chain of custody form, recording the date, time, and purpose of each transfer.
- Evidence must be stored in a secure, locked, environmentally controlled facility with access logs for every entry and exit.
- The order of volatility dictates that you collect the most easily lost data first: registers, caches, memory, and then disk storage.
- Tamper-evident seals with unique numbers are mandatory when transporting evidence between locations.
- A broken chain of custody, even a missing signature, can make evidence inadmissible in court, regardless of its probative value.
- Documentation must be contemporaneous (written at the time of the action), not reconstructed from memory later.

## FAQ

**What happens if the chain of custody is broken?**

If the chain of custody is broken, the evidence may be ruled inadmissible in court. The judge will exclude it, meaning it cannot be used to prove guilt or innocence. In some cases, the entire case can collapse if the broken chain involves critical evidence.

**Can I use a USB copy instead of a forensic image?**

No. A USB copy (drag-and-drop) only copies visible files. It does not capture deleted files, file slack, or unallocated space. A forensic image captures every single bit on the drive, including areas that may hold valuable evidence. You must use forensic imaging software for legal admissibility.

**Do I need a write blocker if I am just taking a picture of the device?**

No. A write blocker is only needed when connecting the device to a computer for imaging or analysis. Taking a photograph does not involve any data transfer or risk of modification. However, you still need to handle the device with gloves to avoid fingerprints and contamination.

**How long do I have to keep the original evidence after creating the image?**

You must keep the original evidence for the entire duration of the investigation and trial, plus whatever statutory retention period applies (often years or permanently). The original is the definitive proof of integrity. Do not destroy or return it until you receive explicit legal or organisational authorisation.

**Is it okay to analyse a suspect's laptop while it is still running?**

Sometimes, if the laptop is a running server or a device that cannot be powered down without losing critical volatile data (like RAM contents). In that case, you perform live forensics: capture memory, running processes, and network connections first. But for standard laptops, it is safer to power down and image the drive. Analysing a running system changes data, so it must be documented and justified.

**What information should I put on the evidence label?**

The label should include a unique evidence identifier, a brief description of the item (e.g., 'Black Dell Latitude laptop, model E7470, serial 123ABC'), the date and time of collection, the name of the person who collected it, and the case number. Do not overcomplicate it; the chain of custody form contains the full detail.

**Can I reuse an anti-static bag for different pieces of evidence?**

No. Each piece of evidence must go into its own new, clean anti-static bag. Reusing bags can introduce cross-contamination (e.g., fibres from a previous item) and destroy the individual chain of custody. Use a fresh bag for every item.

## Check your understanding

1. **What is the primary purpose of a write blocker when imaging a hard drive?**

   Answer: To prevent any data from being written to the original drive during the imaging process, ensuring that the original evidence remains unchanged.

2. **Name three mandatory pieces of information that must appear on every chain of custody form entry.**

   Answer: Unique evidence identifier, date and time of transfer, and signatures of both the person handing over and the person receiving the evidence.

3. **Why is a forensic image considered better than a simple file copy for preserving digital evidence?**

   Answer: A forensic image captures every bit on the drive, including deleted files, file slack, and unallocated space, while a file copy only captures visible files and folders.

4. **What should you do if the tamper-evident seal on an evidence bag is broken when it arrives at the lab?**

   Answer: Document the breakage, contact the sender, and if the chain cannot be validated, consider rejecting the evidence as potentially compromised.

5. **List the correct order of volatility (from most to least volatile) for a live system during evidence collection.**

   Answer: Registers and cache, routing tables and ARP cache, process table, kernel statistics, memory (RAM), temporary file systems, and then disk storage.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-chfi/evidence-handling-and-chain-of-custody