How to Keep a Digital Chain of Custody

Tracking data and equipment with a chain of custody process will help evidence stand up in court

Don't get her wrongcomputer forensics investigator Kris Haworth loves the show Law & Order. But when an episode involves computers, "they always mishandle the evidence, and it kills me," says Haworth, a director with Navigant Consulting's Discovery Service Practices. "Every now and again, they'll have the cop who's investigating the murder go into the suspect's house and just pop on the computer"thus showing blatant disregard for the evidence (but high regard, of course, for prime-time drama).

Let's call it rule number one for computer forensics: Don't count on getting your training from a TV show. Here's some more advice, straight from the experts, on how to handle digital evidence.

DO expect that all evidence will end up in court.

A chain of custody is the process of validating how any kind of evidence has been gathered, tracked and protected on its way to a court of law. A sloppy or nonexistent chain of custody may end up being enough for a simple internal investigation of an employee. But it's better not to take the chance. Instead, get in the habit of protecting all evidence equally so that it will hold up in court.

"If you don't have a chain of custody, the evidence is worthless," says John Petruzzi, director of enterprise security at Constellation Energy. "Deal with everything as if it would go to litigation."

DON'T wait until you have the evidence to make a plan for protecting it.

To prove chain of custody, youll need a form that details how the evidence was handled every step of the way. This form should answer these five W's (plus an H):

What is the evidence?

How did you get it?

When was it collected?

Who has handled it?

Why did that person handle it?

Where has it traveled, and where was it ultimately stored?

(Go to www.csoonline.com/printlinks to download a sample form from Navigant.)

DO guard the "best evidence" closely.

Digital evidence is different from physical evidence, in that a carefully protected image of a hard drive is as good as the original hard drive in the eyes of a court. The first image of a hard drive that investigators take is known as the "best evidence," because it's closest to the original source. The chain of custody form should be attached to the best evidence and stored under lock and key.

Ideally, if you do lots of investigations, the evidence should be stored offsite, but it may be more practical to keep everything onsite in a fireproof safe.