Cyberstudy
Supplementary — not from your PDF Intermediate ~30 min

Preserve evidence with hashes and chain of custody

Practise collecting a copy of some files as evidence: hash them, log every handover on a chain-of-custody form, and later prove nothing has changed.

Environment

Your own computer and a USB drive or separate folder. Use test files you create.

Before you start

  • Read Acquisition (p.309), Preservation (p.313) and Due Process and Legal Hold (p.308).

You will

  • Hash evidence at collection
  • Keep a chain-of-custody record
  • Verify integrity later

Steps

  1. 1

    Create an 'incident' folder with a few test files: a text note, an image, a small log file.

  2. 2

    Copy the folder to an 'evidence' location, e.g. a USB drive.

  3. 3

    Hash every file right away (Get-FileHash or sha256sum) and save the hashes to hashes.txt.

  4. 4

    Write a chain-of-custody form: item description, collected by, date/time, location, hash, and a handover table (from, to, date/time, purpose, signature).

  5. 5

    Record a pretend handover to an 'analyst' on the form.

  6. 6

    A day later, re-hash the evidence copy and compare it with hashes.txt to prove it's unchanged.

  7. 7

    Change one file on purpose in a separate copy, and see how the hash comparison exposes it.

Check your understanding

  • ?Why hash at the moment of collection rather than later?
  • ?What does a gap in the chain-of-custody record do to evidence in court?
  • ?Why do investigators work on copies, not the originals?