Digital forensics principles: integrity, chain of custody and admissibility

What digital forensics is for

Digital forensics is the process of finding, preserving and analysing data from computers, phones, networks and cloud services in a way that others can trust. The audience might be a court, an employment tribunal, an insurer or just your own management deciding what happened during an incident.

It overlaps with incident response but has a different priority. Incident response wants to stop the damage quickly. Forensics wants to prove what happened, and proof requires care. In practice you balance both: you contain the attack, but you avoid destroying evidence while you do it.

The core principles

Several guides say similar things in different words. In the UK, the ACPO Good Practice Guide for Digital Evidence set out four principles that are still widely taught. Internationally, ISO/IEC 27037 covers identifying, collecting and preserving digital evidence, and NIST SP 800-86 explains how to build forensics into incident response. The shared ideas are:

• Do not change the original. Work on verified copies wherever possible.
• If you must touch live data, be competent and explain why. Running a tool on a live machine changes it a little, so record what you did and the effect it had.
• Keep an audit trail. Another qualified examiner should be able to follow your notes and reach the same result.
• Someone is accountable. The person in charge of the investigation makes sure these rules are followed.

Integrity and chain of custody

A cryptographic hash such as SHA-256 acts as a fingerprint of the data. You hash the original when you collect it and hash the copy later; if the values match, the copy is identical. Try it with the hash generator tool: change one character and the whole hash changes. On Linux you would record a value like this:

sha256sum evidence-laptop01.E01 > evidence-laptop01.sha256
sha256sum -c evidence-laptop01.sha256

The chain of custody is the written history of who had the evidence, when, where it was stored and why it moved. A typical form records:

Admissibility and documentation

Evidence is admissible when a court or hearing is willing to consider it. Rules differ by country, but the questions are similar: was it collected lawfully, is it what you say it is, has it been altered, and are your methods reliable? Collecting data without proper authority, for example reading an employee’s private messages without a lawful basis, can make evidence unusable and expose you to legal risk. Involve legal or HR advisers early.

Write contemporaneous notes, meaning notes made at the time, with times in a stated time zone (UTC is easiest). Photograph the scene and screens before you touch anything. Record tool names and versions. Your final report should separate facts ("this file was created at 09:14") from opinions ("this suggests the user ran the installer").

Tip: in exams, if a question mentions evidence being "altered" or "challenged", the answer usually involves hashing, write blocking and chain of custody.