Evidence Collection and Preservation

Lecture Note: Evidence Collection and Preservation

Introduction

Evidence collection and preservation are critical stages in incident response and digital forensics. The goal is to gather, handle, and store data in a way that maintains its integrity, authenticity, and admissibility in legal or investigative contexts.

Objectives of Evidence Collection

• To identify and document all relevant data sources.
• To collect potential evidence without altering or contaminating it.
• To maintain a proper chain of custody for legal validity.
• To ensure the evidence can be reproduced and verified by others.

Types of Digital Evidence

• Volatile evidence: Data that disappears when a system is powered off (e.g., RAM contents, running processes, network connections).
• Non-volatile evidence: Data stored permanently (e.g., hard drives, USB devices, logs, emails).
• Network evidence: Packets, flow records, firewall logs.
• Application evidence: Database entries, web logs, or user activity records.

Principles of Evidence Collection

1. Minimize handling: Avoid altering the original source of data.
2. Use approved tools and methods: Employ forensically sound tools.
3. Document everything: Record the who, what, when, where, and how of each step.
4. Maintain chain of custody: Every person handling the evidence must be documented.
5. Preserve integrity: Use cryptographic hashes (e.g., MD5, SHA-256) to verify data integrity.

Evidence Collection Process

1. Identification: Determine what data might be relevant.
2. Collection: Acquire the data using forensically sound methods.
3. Preservation: Securely store evidence to prevent alteration or loss.
4. Examination: Analyze collected data in a controlled environment.
5. Documentation: Maintain detailed logs of actions, tools, and findings.

Chain of Custody

A chain of custody form tracks every step of evidence handling:

• Description of the item
• Date/time of collection
• Collector’s name and signature
• Transfer history (who received, when, and why)
• Storage location and condition

Any gap in this chain can make the evidence inadmissible in court.

Preservation Best Practices

• Create bit-by-bit forensic images of storage devices.
• Store originals in tamper-proof containers.
• Use read-only media for analysis to prevent modification.
• Label evidence clearly and consistently.
• Secure storage with limited access (e.g., evidence lockers).

 Tools Commonly Used

• Imaging: FTK Imager, dd, EnCase
• Hashing: md5sum, sha256sum
• Network Capture: Wireshark, tcpdump
• Memory Capture: Volatility, Belkasoft RAM Capturer

 Legal and Ethical Considerations

• Respect privacy laws and organizational policies.
• Obtain proper authorization before collection.
• Ensure actions are defensible and can be explained in court.

 Summary

Effective evidence collection and preservation form the foundation of any reliable digital investigation. Following standardized procedures ensures that the evidence remains authentic, credible, and admissible throughout the forensic process.