PDF p.313
In progress
Preservation
Summary
PDF p.313Preservation ensures that evidence collected at a crime scene is protected from tampering and maintains a valid timeline. This involves tightly controlled access, video recording the acquisition process, and using tools like write blockers to prevent data alteration.
In plain words
Supplementary — not from your PDFPreservation keeps evidence trustworthy. Control access, video the acquisition, and use a write blocker so the source can't be changed. Hash the original (MD5 or SHA), make a bit-by-bit image, hash the image to prove it matches, and analyze a copy. Maintain a chain of custody: tamper-evident bags, and a log of every handler, method and tool. Store evidence securely, protected from damp, static and fire.
Detailed explanation
PDF p.313Evidence Collection
- Timeline Validity: Ensure evidence conforms to a valid timeline.
- Controlled Access: Prevent tampering by tightly controlling access.
- Video Recording: Establishes provenance by recording the acquisition process.
Forensically Sound Image
- Capture Tool: Must not alter data or metadata on the source disk.
- Write Blocker: Prevents data changes by filtering write commands.
Evidence Integrity and Non-Repudiation
-
Process
- 1. Cryptographic Hash: Create a hash of the disk media using MD5 or SHA.
- 2. Bit-by-Bit Copy: Make a copy using an imaging utility.
- 3. Second Hash: Create a hash of the image to match the original.
- 4. Reference Image Copy: Validate with checksum and perform analysis on the copy.
- Purpose: Ensures non-repudiation by proving no modification to the image.
Chain of Custody
- Labeling and Sealing: Use tamper-evident bags with antistatic shielding.
- Documentation: Record collection, handling, and storage details.
- Integrity: Protects against accusations of tampering or alteration.
- Logging: Every handler must log methods and tools used.
Storage
- Secure Facility: Ensure access and environmental control to protect electronic systems from hazards like condensation, ESD, and fire.
Important terms
taken from the text above- Timeline Validity
- Ensure evidence conforms to a valid timeline.
- Controlled Access
- Prevent tampering by tightly controlling access.
- Video Recording
- Establishes provenance by recording the acquisition process.
- Capture Tool
- Must not alter data or metadata on the source disk.
- Write Blocker
- Prevents data changes by filtering write commands.
- Cryptographic Hash
- Create a hash of the disk media using MD5 or SHA.
- Bit-by-Bit Copy
- Make a copy using an imaging utility.
- Second Hash
- Create a hash of the image to match the original.
- Reference Image Copy
- Validate with checksum and perform analysis on the copy.
- Labeling and Sealing
- Use tamper-evident bags with antistatic shielding.
- Documentation
- Record collection, handling, and storage details.
- Integrity
- Protects against accusations of tampering or alteration.
- Logging
- Every handler must log methods and tools used.
- Secure Facility
- Ensure access and environmental control to protect electronic systems from hazards like condensation, ESD, and fire.
Examples & real-world scenarios
Supplementary — not from your PDF- A write blocker between the evidence drive and the workstation.
- Matching SHA-256 hashes of the source and the image.
- A chain of custody form signed at every handover.
Scenario
In court, the defence claims the evidence image was altered. Matching hashes recorded at acquisition, plus a complete chain of custody log, show it wasn't.
Common mistakes
Supplementary — not from your PDF- Analyzing the original evidence instead of a verified copy.
- Gaps in the chain of custody.
Practical skills
Supplementary — not from your PDF- Describe the hash-verify-copy process and chain of custody.
What I should remember
Key Points PDF p.313-
Evidence Collection
- Timeline Validity: Maintain a valid timeline.
- Controlled Access: Prevent tampering.
- Video Recording: Establish provenance.
-
Forensically Sound Image
- Capture Tool: No data alteration.
- Write Blocker: Prevents changes.
-
Evidence Integrity
- Process: Hashing, copying, validating.
- Purpose: Non-repudiation.
-
Chain of Custody
- Labeling and Sealing: Tamper-evident bags.
- Documentation: Collection and handling records.
- Integrity: Protects against tampering accusations.
- Logging: Methods and tools used.
-
Storage
- Secure Facility: Access and environmental control.