HackBlue

Tools · Incident response playbooks · 05 / 20

Chain of custody for digital evidence: forms, hashes, and handling

Record who collected, transferred, and accessed each item of evidence, verify integrity with hashes, and store evidence so it remains trustworthy if the incident goes to court.

8 min read · practice only with authorization

What chain of custody proves

Chain of custody is the documented history of an evidence item from collection to final disposition. It shows who had it, when, where it was stored, and what was done to it. If an incident leads to legal action, insurance claims, or employment decisions, gaps in custody can make evidence unusable.

What to record

For each item: a unique ID, description (device make, model, serial, or file name), source system, collector, date and time with time zone, collection method and tool version, hash values, storage location, and every transfer with signatures or authenticated log entries.

Snippet
Evidence ID: IR014-E03
Description: Memory image, HOST FIN-LT-042
Collected by: A. Rivera, 2026-11-02 14:12 UTC, WinPmem 4.x to USB SN 7731
SHA-256: 9f2c...e41a
Stored: Evidence locker 2, encrypted volume IR014
Transfers:
  2026-11-02 15:05 UTC  A. Rivera -> M. Chen (forensic analysis)  reason: memory analysis
  2026-11-03 09:30 UTC  M. Chen -> evidence locker 2

Lab: hash, copy, verify

Create a small test evidence file, record its SHA-256 hash in a custody form, copy it to another drive, and verify the copy’s hash matches. Then modify one byte of the copy and show the hash no longer matches. Work only from verified copies; the original stays sealed.

Snippet
sha256sum mem.raw | tee mem.raw.sha256
cp mem.raw /mnt/analysis/
cd /mnt/analysis && sha256sum -c ../mem.raw.sha256
# PowerShell
Get-FileHash .\mem.raw -Algorithm SHA256

Storage and access

Store evidence on encrypted, access-controlled storage with logging. Analysts work on copies, never the original. Retention follows your legal hold and policy; disposal is recorded too.

Diagram

Evidence item lifecycle

  1. Collect

    Record source, collector, time, tool, and hash.

  2. Store

    Seal or place on encrypted, logged storage.

  3. Transfer

    Log every handoff with reason and signatures.

  4. Analyze copies

    Verify hash before and after analysis.

Check yourself

1. What does chain of custody document?

2. How do you show a copy is identical to the original?

3. Where should analysts perform analysis?