Investigations and evidence

Sooner or later every security team has to find out what happened and prove it. An employee may be suspected of copying customer lists before resigning. A regulator may ask how personal information came to be exposed. Police may request records about a fraud that passed through the company's systems. A customer may sue over a service failure. In each case the organization needs an investigation that is lawful, fair and thorough, and evidence that will stand up to scrutiny by managers, auditors, regulators and possibly a court.

Sub-domain 7.1 of the CISSP outline, understand and comply with investigations, expects a manager's command of investigation types, evidence handling, the main legal rules about admissibility and the practical steps that keep an investigation defensible. It does not expect you to perform technical forensics. This lesson keeps to that level: what investigators must preserve and document, who should be involved, and how the law in Canada and the United States shapes the process. Specialist digital forensic work is done by trained examiners using validated tools, under the governance described here.

Types of investigation

The type of investigation determines its purpose, who leads it, the standard of proof and what the organization may do with the results. Confusing the types is a common and costly mistake, because an investigation that starts as an internal HR matter can turn into a criminal case, and evidence handled casually at the start may be unusable later.

Because any internal investigation might later become civil, criminal or regulatory, the safest practice is to handle evidence from the first day as if it may end up in court. That does not mean every HR matter needs a forensic laboratory, but it does mean preserving original data, documenting who did what and when, and involving legal counsel early when the stakes are high. In both countries, involving counsel early can also bring the investigation under solicitor-client (Canada) or attorney-client (US) privilege and litigation privilege or work-product protection, which can keep sensitive analysis confidential. Privilege depends on facts and must be planned with counsel, not assumed.

What makes evidence useful

Evidence is any information that tends to prove or disprove a fact in issue. Investigators describe evidence by its form and its relationship to the facts. Real evidence is a physical object, such as a laptop or a USB drive. Documentary evidence includes records, emails, logs and contracts. Testimonial evidence is what witnesses say. Direct evidence proves a fact without inference, such as a witness who saw an employee remove a server; circumstantial evidence requires inference, such as logs showing the employee's badge entered the server room just before the server went offline.

For evidence to be useful in any forum it should be relevant (related to a fact in issue), reliable (accurate and produced by a trustworthy process), complete (not selectively extracted) and authentic (shown to be what it claims to be). Digital evidence raises special concerns: it is easy to alter without trace, it can be changed simply by examining it carelessly, and much of it is produced automatically by systems whose reliability must itself be shown.

Chain of custody

The chain of custody is the documented, unbroken record of who has had possession of an item of evidence, from the moment it was collected until it is presented or disposed of, together with what was done to it and why. Its purpose is to show that the evidence presented is the same evidence that was collected and that it has not been altered, substituted or contaminated. A gap in the chain does not automatically make evidence worthless, but it invites challenge and reduces the weight a decision-maker gives it.

A good custody record captures, for each item: a unique identifier; a description, including make, model and serial number for devices; where, when and by whom it was found and collected; each transfer, with date, time, the people releasing and receiving it, and the purpose; storage location and conditions; and for digital evidence, the cryptographic hash values computed at collection and at each later verification. Evidence is sealed in tamper-evident bags or containers, stored in a locked area with access logs, and handled by as few people as possible.

import hashlib, json
# Integrity check of a preserved evidence file against the value recorded at collection
evidence = b'2026-09-14T02:11:08Z host=fin-db01 user=svc_backup action=export rows=48211\n' * 3
collected_hash = hashlib.sha256(evidence).hexdigest()
log = [
    {'when': '2026-09-14 09:05', 'from': 'J. Park (collector)', 'to': 'Evidence locker 2', 'purpose': 'Initial storage'},
    {'when': '2026-09-15 13:20', 'from': 'Evidence locker 2', 'to': 'R. Diaz (examiner)', 'purpose': 'Create working copy'},
    {'when': '2026-09-15 16:45', 'from': 'R. Diaz (examiner)', 'to': 'Evidence locker 2', 'purpose': 'Return original'},
]
later_copy = bytes(evidence)
print('Collected SHA-256 :', collected_hash[:32], '...')
print('Verified SHA-256  :', hashlib.sha256(later_copy).hexdigest()[:32], '...')
print('Integrity verified:', hashlib.sha256(later_copy).hexdigest() == collected_hash)
print('Custody transfers recorded:', len(log))
for e in log:
    print(f"  {e['when']}  {e['from']} -> {e['to']}  ({e['purpose']})")

Collected SHA-256 : 85020e10996b83e540133a529cfcffc7 ...
Verified SHA-256  : 85020e10996b83e540133a529cfcffc7 ...
Integrity verified: True
Custody transfers recorded: 3
  2026-09-14 09:05  J. Park (collector) -> Evidence locker 2  (Initial storage)
  2026-09-15 13:20  Evidence locker 2 -> R. Diaz (examiner)  (Create working copy)
  2026-09-15 16:45  R. Diaz (examiner) -> Evidence locker 2  (Return original)

Hash values are the digital equivalent of a tamper-evident seal. If the hash of a preserved image matches the value recorded at collection, any change, even of a single bit, would have produced a different value. Examiners analyze verified working copies, never the original, so the original can be re-examined by another expert if the findings are challenged.

Order of volatility and collection priorities

Some digital evidence disappears quickly. The contents of memory vanish when a system is powered off; network connections and running processes change by the second; temporary files are overwritten; logs roll over on schedule; while data on disks and backups persists far longer. The order of volatility is the principle that collection should generally begin with the most volatile sources and move to the most persistent. RFC 3227, a long-standing guideline on evidence collection, describes this ordering.

Order of volatility is a planning concept, not a recipe, and it must be balanced against other priorities. Pulling the plug on a server preserves the disk but destroys memory; leaving it running preserves memory but lets an intruder, or an automatic process, keep changing data. Business needs matter too: shutting down a payment system has costs. These decisions should be made by people with the authority and skill to make them, following a pre-approved procedure, and recorded with the reasons. For managers, the key point is that responders should be trained and equipped before an incident, because improvised collection is where evidence is most often lost.

Legal holds and e-discovery

When litigation or a regulatory investigation is reasonably anticipated, the organization has a duty to preserve relevant information. A legal hold (litigation hold) is the instruction, usually issued by legal counsel, that suspends normal deletion and rotation for specified records and systems. Security and IT operations implement it: pausing automatic deletion, preserving mailboxes of departing custodians and keeping backups that would otherwise be overwritten. Failing to preserve can lead to court sanctions or adverse inferences, so legal holds must be tracked, communicated to custodians and released formally when the matter ends.

Electronic discovery (e-discovery) is the process of identifying, preserving, collecting, reviewing and producing electronically stored information in litigation. In the United States, the Federal Rules of Civil Procedure set detailed expectations, and many practitioners use the Electronic Discovery Reference Model to describe the stages. In Canada, the Sedona Canada Principles are widely referenced by courts and practitioners, alongside provincial rules of civil procedure. Good records management, including a retention schedule and knowing where data lives, makes discovery far cheaper and less risky.

Admissibility: the law in your country

In the United States, federal courts apply the Federal Rules of Evidence, and most states have similar rules. Rule 901 requires authentication: evidence sufficient to support a finding that the item is what its proponent claims. Rules 902(13) and 902(14), added in 2017, allow records generated by an electronic process or system, and data copied from a device, storage medium or file, to be self-authenticated by a certification from a qualified person, including through hash value identification. Logs and other records may be hearsay, but Rule 803(6), the business records exception, admits records made at or near the time in the regular course of a regularly conducted activity, if the conditions are met. The best evidence rule (Rules 1001 to 1004) generally accepts an accurate printout or copy of electronically stored information as an original. Search and seizure by government is governed by the Fourth Amendment; private employers must comply with the Electronic Communications Privacy Act and state laws on monitoring and privacy, such as notice requirements for electronic monitoring in New York and Connecticut.

Running an internal investigation fairly

Many investigations never reach a court, but they still affect people's livelihoods and reputations, and they can be reviewed later by tribunals, arbitrators or courts. A defensible internal investigation has a clear mandate and scope approved by an appropriate executive, an investigator who is independent of the matter and competent, a plan that considers legal privilege, privacy and employment law, interviews conducted fairly with notes kept, and conclusions that follow from the evidence. The person under investigation should normally have a chance to respond before conclusions are reached. Monitoring of employees must comply with the organization's own notices and policies; evidence gathered by monitoring that employees were never told about, or that goes beyond what policy allows, may be challenged.