How to Keep a Digital Chain of Custody

A chain of custody process for tracking data and equipment will help evidence stand up in court

By Sarah D. Scalet

December 01, 2005 — CSO —

Don't get her wrong—computer forensics investigator Kris Haworth loves the show Law & Order. But when an episode involves computers, "they always mishandle the evidence, and it kills me," says Haworth, a director with Navigant Consulting's Discovery Service Practices. Rarely if ever is the chain of custody concept maintained that is crucial for producing evidence admissable in court. "Every now and again, they'll have the cop who's investigating the murder go into the suspect's house and just pop on the computer"—thus showing blatant disregard for the evidence (but high regard, of course, for prime-time drama).

Let's call it rule number one for computer forensics: Don't count on getting your training from a TV show. Here's some more advice, straight from the experts, on how to handle digital evidence.

DO expect that chain-of-custody evidence will end up in court.

A chain of custody is the process of validating how any kind of evidence has been gathered, tracked and protected on its way to a court of law. A sloppy or nonexistent chain of custody may end up being enough for a simple internal investigation of an employee. But it's better not to take the chance. Instead, get in the habit of protecting all evidence equally so that it will hold up in court.

"If you don't have a chain of custody, the evidence is worthless," says John Petruzzi, director of enterprise security at Constellation Energy. "Deal with everything as if it would go to litigation."

DON'T wait until you have the evidence to make a plan for protecting it.

To prove chain of custody, you'll need a form that details how the evidence was handled every step of the way. This form should answer these five W's (plus an H):

• What is the evidence?
• How did you get it?
• When was it collected?
• Who has handled it?
• Why did that person handle it?
• Where has it traveled, and where was it ultimately stored?

DO guard the "best evidence" closely.

Digital evidence is different from physical evidence, in that a carefully protected image of a hard drive is as good as the original hard drive in the eyes of a court. The first image of a hard drive that investigators take is known as the "best evidence," because it's closest to the original source. The chain of custody form should be attached to the best evidence and stored under lock and key.

Ideally, if you do lots of investigations, the evidence should be stored offsite, but it may be more practical to keep everything onsite in a fireproof safe.

DON'T work off the best evidence.

After the best evidence is gathered, a second copy should be made, either from the original or from the best evidence. This is the working copy that investigators use for their research. This step can seem needless. "Sometimes the mind-set is, if we didn't seize the computer itself, why does it matter if it's the working copy or the first copy?" says Haworth, a licensed attorney. But "best evidence" is a distinction that lawyers likeand really, the point with chain of custody is to avoid doing anything that a lawyer might not like.

• Print

• No More Lost Backup Tapes: Chain of Custody Security Measures
• Safe Document Transfer: How to Secure the Paper Chain
• The Seven Deadly Sins of Records Retention