Evidence handling and chain of custody

Before the Riverside laptop was reimaged on November 9, Keisha did three things that puzzled Jordan. She used the EDR console to collect a package of data from the isolated laptop. She saved a copy of the malicious email and its attached document into a locked evidence folder, then calculated and wrote down a long string of letters and numbers for each file. And she filled in a one-page form recording who had handled each item, when and why. Jordan pointed out that nothing had actually happened. Keisha agreed, and said that was exactly why it was a good time to practise. On the day something does happen, she told him, the habits have to be automatic, because evidence handled carelessly in the first hour can never be fixed later.

This lesson covers the basics of digital forensics for a support technician: why evidence matters, what to preserve and in what order, how hashing proves that evidence has not changed, how a chain of custody is kept, what attribution means and why it is hard, and when to hand the work to specialists or the police.

Why evidence matters

Digital evidence serves several purposes. It lets the response team understand what happened and make sure the attacker is really gone. It supports decisions about notification, because whether personal data was accessed often depends on what the logs and disk show. It may be needed by an insurer to pay a claim, by a lawyer in a dispute, by a regulator, or by police and prosecutors if a crime is charged. In each case, someone may ask two questions: is this the real data, and has it been changed? Good evidence handling makes the answer to both questions easy to prove.

The CCST exam expects familiarity with digital forensics and attribution processes, not the skills of a forensic examiner. A technician's job is usually to recognize when evidence matters, preserve it correctly, avoid destroying it and hand it to the right people. Full forensic analysis is a specialized field with its own training, tools and certifications.

Preserve first: do no harm

The first rule is to avoid changing what you are trying to preserve. Every action on a live system changes it: logging in writes event entries, opening a file updates its access time, running a tool loads it into memory and can overwrite deleted data. Turning a device off loses everything in memory, including running processes, network connections and sometimes encryption keys. There is no perfect choice, so the response plan should say what to do in the common cases, and a technician who is unsure should stop and escalate rather than experiment.

For a suspected compromise, the usual guidance for a technician is: do not turn the device off, do not keep using it, do not run cleaning tools or install new software on it, isolate it from the network, ideally through EDR so that remote collection is still possible, write down what you see and when, and call the incident lead. If the screen shows something important, such as a ransom note or an attacker's open session, photograph it.

The order of volatility

Different kinds of data disappear at different speeds. The order of volatility, described in a widely used guide published by the Internet Engineering Task Force as RFC 3227, says to collect the most volatile evidence first.

• CPU registers and cache, which change constantly and are rarely collected outside specialist work.
• Memory, including running processes, open network connections, logged-in users and the routing and address tables.
• Temporary files and swap space.
• Disk contents, including files, deleted data and system logs stored on the device.
• Remote logs and monitoring data, such as the SIEM, firewall and EDR records, which are usually safe but may be overwritten after their retention period.
• Backups and archived media, which change least.

EDR tools make memory and process collection far easier than it used to be, because the agent can gather a triage package remotely, in a consistent way, without someone typing commands on the affected machine. That is what Keisha collected from the Riverside laptop before it was wiped.

Hashing and integrity

A cryptographic hash function turns any amount of data into a fixed-length value, the hash, that acts like a fingerprint. Change a single bit of the data and the hash changes completely. CSCO-121 introduced hashing for passwords and file integrity; in forensics it proves that evidence has not been altered. When evidence is collected, its hash is calculated and recorded. Anyone who later calculates the hash again and gets the same value can be confident the data is identical. SHA-256 is the usual choice today. Older functions such as MD5 and SHA-1 are no longer considered secure against deliberate tampering, although some tools still display them alongside SHA-256.

import hashlib

evidence = b"From: filings@court-notice.example\nSubject: Filing received - action required\n"
recorded = hashlib.sha256(evidence).hexdigest()
print('Hash recorded at collection:', recorded)

# Later, an examiner checks the same file
later = hashlib.sha256(evidence).hexdigest()
print('Matches the record:', later == recorded)

# A single changed character gives a completely different hash
tampered = evidence.replace(b'action', b'Action')
print('Tampered copy matches:', hashlib.sha256(tampered).hexdigest() == recorded)
print('Tampered hash:', hashlib.sha256(tampered).hexdigest()[:16], '...')

Hash recorded at collection: e08f750f3e4d690ff5666e7ffc54d2dd5002a183148b64fbae3d95f97f49b28c
Matches the record: True
Tampered copy matches: False
Tampered hash: 157d2cac97ebd407 ...

On real systems, hashes are calculated with built-in commands rather than a script. The commands below calculate a SHA-256 hash of the saved email file on Windows, macOS and Linux. The output is the same value on every system for the same file, which is what makes hashes useful across teams and tools.

# Windows
certutil -hashfile notice.eml SHA256
# macOS
shasum -a 256 notice.eml
# Linux
sha256sum notice.eml

Copies, images and write protection

Analysts work on copies, never on the original evidence. For a disk, a forensic image is a bit-for-bit copy of the whole drive, including empty space where deleted files may remain. Images are made with hardware or software write blockers, which let the drive be read but prevent anything from being written to it, and the image is hashed when it is made. Two verified copies are usually kept: one stored untouched as the master and one used for analysis. Cloud data and logs are preserved by exporting them through the provider's tools and hashing the exports, or by placing accounts on hold so that data cannot be deleted.

Chain of custody

A chain of custody is the documented history of who has had possession of a piece of evidence from the moment it was collected, what they did with it and why. It proves that the evidence was not lost, swapped or tampered with. A gap in the chain does not always make evidence useless, but it gives anyone who wants to challenge it an easy argument.

Brightline's form recorded the ticket number, a description of each item, its serial number or file name, its hash, who collected it, when and where, and then a line for every transfer: who released it, who received it, when and for what purpose. Physical items such as a laptop or USB drive went into a sealed, labelled evidence bag, and the seal was signed. Digital items went into a folder that only the incident lead could change, with every access logged. Keisha's form for the Riverside event had three items: the EDR package, the email file and the attached document, each with its SHA-256 hash.

Legal hold and working with the police

When litigation, a regulatory investigation or a criminal case is reasonably expected, organizations may need to preserve relevant data rather than delete it under normal retention rules. This is called a legal hold, or a litigation hold, and it is usually triggered by a lawyer. Technicians help by suspending automatic deletion for the relevant mailboxes, files and logs and by documenting what was preserved.

If a crime may have occurred, such as fraud, extortion or ransomware, the organization may report it to police. In Canada that usually means the local police service, and fraud can also be reported to the Canadian Anti-Fraud Centre. Police may ask for evidence to be preserved in a particular way, and following the chain of custody from the start makes their work far easier. Courts in both countries accept electronic evidence when its integrity can be shown, and the Canada Evidence Act sets out how electronic documents are authenticated. Whatever the details, hashes and a clean chain of custody are the backbone of that proof.

Attribution

Attribution means identifying who was behind an attack. It is one of the hardest problems in security. Attackers hide behind compromised computers, rented servers, anonymizing networks and stolen accounts. They reuse each other's tools, and some deliberately plant misleading clues, called false flags, to point investigators at someone else.

Analysts build attribution from several kinds of evidence: indicators of compromise such as file hashes, domains and addresses; the tactics, techniques and procedures, or TTPs, that a group habitually uses, often described with the MITRE ATT&CK framework; overlaps in infrastructure with earlier attacks; language and timing clues; and intelligence that only governments hold. Even with all of this, attribution is usually expressed with a level of confidence, not as certainty.

For a small organization, attribution is rarely the priority. Knowing whether an attack came from a particular criminal group seldom changes what needs to be done: contain it, remove it, recover and notify. Keisha's advice to Jordan was to collect and preserve the indicators, share them with trusted partners and leave attribution to law enforcement and specialist firms. What matters most to the client is that the attacker is out and stays out.