Evidence is rarely excluded because someone tampered with it. It is excluded because the prosecution cannot demonstrate that nobody could have. Those are different standards, and the second one is met with paperwork discipline rather than technology.
The four questions a custody record must answer
For any exhibit, at any moment from seizure to disposal, your record should answer: who held it, where it was, what was done to it, and how you know it did not change. If any of those has a gap, that gap is the cross-examination.
Hashing is a control, not a ritual
Computing a hash at acquisition is standard practice. Recomputing it is where laboratories get lazy. A hash taken once at imaging and never verified again proves only that the image was internally consistent at the moment it was made. Verify on receipt, verify before analysis, verify before export, and record each verification with the value, the algorithm and the examiner.
Use an algorithm that is still respectable. MD5 remains in wide use for legacy compatibility, but a report that rests on MD5 alone invites an argument you do not need to have. Record SHA-256 alongside it.
Time is the detail that catches people out
Device clocks drift, are set to the wrong zone, or are deliberately altered. Record the device time and the true time at seizure, and note the difference. Every timestamp in the eventual report inherits that offset, and an unexplained discrepancy between the exhibit's timeline and an independent record — CCTV, call data, a bank log — is the fastest way to lose a tribunal's confidence.
Working copies, not originals
- Analyse a verified working copy. The original image is archived and untouched.
- If a tool must write to the exhibit, record that it does, why it was necessary, and what changed.
- Store the original and the working copy on separate media, and record where both live.
- Log every access to the archive, including reads.
Write the report for the person who will challenge it
A forensic report has two audiences: the investigator who needs the finding, and the expert the other side will instruct to attack it. Separate them explicitly. An executive summary that states the finding in plain language, and a technical section with the method, the tool versions, the hashes and enough detail for the finding to be reproduced by someone who does not trust you.
If your method cannot be reproduced by a hostile examiner, it is an opinion rather than a finding.
This is procedural discipline, and it costs examiner hours. It is also the difference between a laboratory that produces intelligence and one that produces evidence.
Sources and further reading
External links, provided for verification. CyberEdge is not responsible for third-party content.