Chain Of Custody For Electronic Evidence

Summary

Article Overview: Chain of custody is critical for ensuring the authenticity and admissibility of electronic evidence in legal proceedings. A well-documented chain of custody proves that best practices were followed in collecting, analyzing, and handling digital evidence, and that the evidence's integrity was maintained throughout the process.

Chain of Custody for Electronic Evidence: A Comprehensive Guide

Chain of custody is a critical process for handling electronic evidence to ensure it is admissible in legal proceedings. It refers to the documentation and tracking of the movement and handling of evidence from the time it is collected until it is presented in court. A properly maintained chain of custody proves the authenticity of the evidence and that it has not been altered or tampered with. This is especially important for electronic evidence, which can be easily modified if not handled correctly.

Here is a step-by-step guide to establishing and maintaining a strong chain of custody for electronic evidence:

Step 1: Identify and Secure the Electronic Evidence

The first step is to identify the electronic devices, media, and data that may contain relevant evidence. This could include computers, mobile phones, hard drives, USB drives, cloud storage, network logs, and more. Once identified, the devices and media must be secured to prevent any changes to the data.

Example: In a corporate fraud investigation, the relevant evidence may reside on an employee's work computer and mobile phone, as well as the company's network servers and cloud storage accounts.

Best practices for securing electronic evidence include:

• Documenting the hardware and device details (make, model, serial number, etc.)
• Photographing the device and surrounding area
• Isolating the device from networks and wireless signals
• Using write-blockers when creating forensic copies of storage media
• Securely transporting and storing devices in anti-static packaging

Step 2: Collect the Electronic Evidence

Forensic data collection should be performed by trained professionals using industry-standard tools and techniques. This ensures the data is acquired in a forensically-sound manner that preserves the integrity of the evidence.

Key considerations for forensic data collection include:

• Documenting all steps taken and tools/settings used
• Using hash verification to prove copies are exact bit-for-bit duplicates
• Collecting ancillary evidence like network logs, access records, etc.
• Maintaining detailed contemporaneous notes
• Following all relevant legal protocols (e.g. Daubert standards)

Example: A computer forensics expert may use a write-blocker and tools like FTK Imager or EnCase to create a verifiable forensic image of a computer's hard drive. A hash value is calculated to prove the copy is an exact duplicate of the original data.

Step 3: Analyze the Electronic Evidence

Once collected, the electronic evidence must be carefully analyzed by skilled examiners. All analysis should be performed on verified forensic copies of the original data to maintain evidence integrity. Examiners look for relevant files, emails, chat logs, internet history, deleted data, and other artifacts that may serve as evidence.

Important considerations for forensic analysis include:

• Maintaining professional certifications (CCE, EnCE, GCFA, etc.)
• Documenting all findings and investigative steps
• Using industry-standard analysis tools and techniques
• Validating software/tools and following ISO 17025 standards
• Preserving analysis copies of data

Example: A certified mobile phone examiner may use Cellebrite UFED or Magnet AXIOM to extract and analyze data from a smartphone. Detailed reports document the tools used and all relevant findings like texts, call logs, photos, app data, and location information.

Step 4: Document and Track the Electronic Evidence

Throughout the entire lifecycle, the chain of custody for the electronic evidence must be carefully documented. This includes tracking who has handled the evidence, when, and for what purpose. Physical and digital chain of custody forms should be used to document the transfer of evidence between parties.

Best practices for evidence tracking include:

• Using standardized chain of custody forms and labels
• Storing evidence in a secure location with restricted access
• Requiring signatures for all evidence transfers
• Implementing an audit log for evidence access
• Regularly reviewing chain of custody records for accuracy

Example: When a computer forensic expert transfers a hard drive to a law firm, both parties sign and date a chain of custody form. This documents exactly when the drive was transferred and who took possession of it. The drive is stored in a secure evidence locker that requires badge access to enter.

Step 5: Present the Electronic Evidence

If the electronic evidence is presented in court, the chain of custody documentation will be used to prove its authenticity and reliability. The forensic examiners involved may be called to testify about their analysis methodology and findings.

Important considerations for evidence presentation include:

• Providing a thorough, understandable explanation of the evidence
• Being prepared to explain tools, techniques, and forensic artifacts
• Demonstrating that industry best practices were followed
• Showing that evidence integrity was maintained at all times
• Addressing challenges to the evidence's admissibility

Example: In a trial, a computer forensics expert presents their findings and the supporting chain of custody documentation. They explain the EnCase forensic software used, the process for creating a verifiable drive image, and the hash values that prove the authenticity of the evidence. The solid chain of custody demonstrates the evidence is trustworthy.

Conclusion

Properly establishing and maintaining chain of custody is essential for electronic evidence to be admissible and convincing in court. By carefully identifying, collecting, analyzing, tracking, and presenting digital evidence, legal and forensic professionals can ensure critical information is available to prove or disprove a case.

A well-documented chain of custody proves that best practices were followed and that the electronic evidence is authentic and reliable. Failing to follow these protocols can lead to evidence being thrown out or deemed untrustworthy.

It is crucial that all parties handling electronic evidence in an investigation or legal matter understand and strictly adhere to the chain of custody procedures. This protects the integrity of the evidence and the outcome of the case.

References

For more insights, read our Divorce Decoded blog.