Digital Chain Of Custody A Practical Guide For Lawyers

CHAINOFCUSTODY · AGUIDEFORUKLAWYERS Digital Chain of Custody: A Practical Guide for Lawyers Continuity, Transfer Records and the Documentation That Survives Court COMPUTERFORENSICSLAB E - DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES FULL CHAIN-OF-CUSTODY DOCUMENTATION CPR PART 35 EXPERT REPORTS COURT-EXPERIENCED EXPERT WITNESSES § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the question every exhibit must answer 03 The two strands: physical and logical custody 04 The custody lifecycle, stage by stage 05 Sample records: the forms that do the work 06 Weak versus defensible: the same events, two files 07 What breaks a chain, and what a break actually costs 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CONTINUITYISPROVEN , NEVERPRESUMED § 0 2 · FIRSTPRINCIPLES The problem in plain English: the question every exhibit must answer § 0 3 · THETWOSTRANDS The two strands: physical and logical custody § 0 4 · THELIFECYCLE The custody lifecycle, stage by stage STAGE CUSTODY ACTIONS § 0 5 · THEPAPERWORK Sample records: the forms that do the work Exhibit record (opened at acquisition, one per exhibit) Transfer record (one row per movement, appended to the exhibit record) FIELD ENTRY (ILLUSTRATIVE) DATE / FROM TIME (SIGNED) TO (SIGNED) PURPOSE SEAL / HASH CHECK 14 Mar [Examiner] Evidence store Storage post- Seal [n] intact; image SHA-256 verified 02 Apr Evidence [Examiner] Examination per Seal [n] intact; opened; working copy 02 Apr [Examiner] Evidence store Return post- Resealed [new seal n]; master untouched, 14 May Evidence [Courier, Delivery to [solicitors] Sealed [n]; copy drive SHA-256 [value] 14 May [Courier] [Recipient, Receipt Seal [n] confirmed intact; drive hash re- § 0 6 · SIDEBYSIDE Weak versus defensible: the same events, two files WEAK DOCUMENTATION SAYS DEFENSIBLE DOCUMENTATION SAYS § 0 7 · BREAKS What breaks a chain, and what a break actually costs § 0 8 · INTHEWILD Worked examples EXAMPLE1 · THECABINETMONTHS EXAMPLE2 · THEGAPTHATWASBOUNDEDANDSURVIVED EXAMPLE3 · THESCHEDULEOFTHEIRGAPS § 0 9 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 0 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CLIENTINSTRUCTIONES TA BLISHINGCUSTO DY FROM DAY ONE SUGGESTEDWORDING · REQUESTFORANOPPONENT ' SCUSTO DY RECORDS § 1 1 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The chain-of-custody checklist Red flags When to involve a digital forensic expert § 1 2 · COMMONQUESTIONS Frequently asked questions Does a broken chain make the evidence inadmissible? We already have material that was handled casually before anyone thought about custody. Is it ruined? Who should hold evidence during litigation: the client, the solicitors or the laboratory? How does chain of custody work for cloud data, where there is no device to seal? Do we really need tamper-evident seals and forms for a modest commercial dispute? What should the chain say when evidence is finally returned or destroyed? § 1 3 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY