Digital Forensics – The Essential Chain of Custody

By Ron McFarland, Ph.D., CEH, CISSP

Figure 1: Chain of Custody, (Kent, 2006)

If you are into Cyber Security, you will be, at one point in your career, involved in Digital Forensics to one degree or another. One of the concepts that is essential to Digital Forensics is the Chain of Custody. As a Cyber Security Consultant and (occasional) Digital Forensics Investigator (e.g. Expert Witness), my experience in testifying includes dealing with many Chain of Custody questions when being cross-examined — whether I was investigating software source code theft (using Forensics techniques) or performing a relevant Penetration test (Pen Test).

Chain of Custody is an essential first-step in cyber forensics investigations. Chain of Custody is essentially documenting the way that we secure, transport and verify that items acquired for investigation were held in an appropriate manner. Chain of custody demonstrates ‘trust’ to the courts and to client that the media was not tampered with. It is an audit trail of ‘who did what’ and ‘when it happened’ to a particular piece of evidence.

Digital evidence is an essential element in uncovering intent, mode and method in computer-related crimes and it is important in many internal investigations when an organization addresses risk mitigation to scope out internal processes. Digital evidence is typically acquired from a myriad of devices including a vast number of IoT devices that store user information and data ‘spores’, digital video and images (which may store important metadata and obfuscated/hidden information), audio evidence, and other stored data on flash drives, hard disk drives, and other physical media.

The process for digital forensics follows a structured path. The process comprises four primary steps:

When acquiring items for evidence, we need to tag each item and log each item into a document. I often use MS/Excel for some basic tracking. However, I do use pre-formatted forms that provide great documentation. Forms are essential, especially if you (a) are working for a professional practice that uses/requires a formatted document for each item in evidence, (b) will be presenting the results of the investigation (e.g. testifying) in court, or (c) if you are working in some capacity as an expert witness. The key elements that require documentation include (and are not limited to):

Keep in mind that NIST (National Institute of Standards and Technology) provides excellent research about Digital Forensics that can be an essential element to either setting up or maintaining a high-quality Digital Forensics practice.

Resource

Kent, K., Chevalier, S., & Grance, T. (2006). Guide to Integrating Forensic Techniques into Incident.