Forensics
Chain of Custody Essentials
- Record acquisition date/time (UTC), examiner, tool + version.
- Hash on acquisition and re-verify before/after analysis.
- Store originals write-protected; analyse only copies.
- Log every command run (
script/teea session log). - Maintain custody transfer records for every handoff.
- Numbered Notebook, a pre numbered notebook in physical format can be used to validate no pages have been removed, leave mistakes in and mark as mistakes whilst remaining visible to avoid evidence tampering accusation.
Capture commands on ‘nix.
# Capture a full command session
tee -a case_session.log
# ... perform work ...
exit