6. Custody and contingencies

Perfect evidence with a gap in its paperwork is an argument waiting to happen. And something always goes wrong on site. This chapter covers the unbroken custody record and the plans you make before you need them.

The quick version

Every hand-over gets recorded: who, to whom, when, why, and both signatures.
Label, seal and photograph each item before it leaves the scene. Digital items get a hash and their own entry.
Encrypted and locked? Do not guess passwords. Image it as it is and chase keys through legitimate sources.
Failing drive? Stop retrying. Switch to fault-tolerant acquisition or escalate.
Never repair the source to make it image. Any repair changes evidence.
Escalation is not failure. Destroying evidence beyond your competence is.

Open this when: evidence is about to change hands, or an acquisition on site has just gone sideways.

In this chapter

Chain of custody (section 10)
Contingency procedures on site (section 11)

10. Documentation

Chain of custody

In short: keep an unbroken record of who has had each item, from seizure to court, so nobody can claim it was altered while unwatched.

Chain of custody is the record of who has had the evidence, from seizure to presentation. Any gap invites the argument that the evidence could have been altered while nobody was watching.

Record every hand-over

For each item of evidence, keep a form that records:

A unique evidence reference, for example case number and item number: CASE-2026-014/03.
A description: make, model, serial number, capacity, distinguishing marks.
Where and when it was found, and by whom.
Every transfer: from whom, to whom, date, time, purpose, and both signatures.
Every examination: who, when, what was done, and whether the seal was broken and re-applied (with old and new seal numbers).
Storage location at each stage.

Label and seal each item

Label it with its evidence reference before it leaves the scene. Label cables and adaptors too, and keep them with their device.
Seal it in a tamper-evident bag. Write the seal number, the date, the time and your name on the form and across the seal.
Photograph the sealed item with the label visible.

Digital items count too

Digital evidence gets the same treatment in digital form: the file's hash, the system it was exported from, the person who exported it and the time. A memory image, a ddrescue map file and a carved fragment are each items of evidence with their own entry.

Test the trail

Ask one question: could a stranger, holding only your paperwork, reconstruct where every item has been and who has touched it, hour by hour, and check each claim against a signature, a seal number or a hash? If yes, the chain holds.

Example

The seized workstation is driven to the laboratory by a colleague who signs for it at 16:40, logs it into the evidence store at 17:55 and signs it out to the examiner at 09:05 the next morning. The examiner records the unbroken seal number before breaking it, images the drives, re-seals the workstation with a new seal and records both numbers. That is a complete chain. "I left it on my desk overnight" is not.

Before you move on

Every item has a unique reference and a custody form.
Every transfer and examination is signed, timed and has a purpose.
Items are labelled, sealed and photographed; seal numbers are on the form.
Digital items (images, map files, carved fragments) have hashes and their own entries.
A stranger could follow the trail hour by hour from your paperwork alone.

11. Preservation, acquisition

Contingency procedures on site

In short: decide in advance what you will do when a device is encrypted, failing or refuses to image, so you do not improvise with the evidence.

Things go wrong on site. What separates a good examiner from a lucky one is having decided in advance what to do when they do.

Handle encrypted devices

You find it	Do this
On and unlocked	Keep it that way. Prevent sleep if you can do so without typing (connecting mains power is usually safe). Capture memory, record the encryption status, and take a logical copy of any mounted encrypted volume before powering off. Then image the encrypted disk physically.
Off or locked	Do not guess passwords. Image the encrypted drive as it is (the image is valid evidence and can be decrypted later) and pursue keys through the legitimate sources in section 12.

Stop and think

Repeated password failures can trigger lockouts or wiping. One guess too many can cost you the whole device.

Record every encryption indicator you see, including the exact prompt text and any recovery key identifier shown.

Handle damaged or unstable storage

Clicking, spinning up and down, or very slow reads mean the drive is failing. Stop, photograph, and switch to fault-tolerant acquisition (section 8) or escalate, rather than repeatedly retrying.
Physically damaged devices (water, fire, crushed phones) go to a specialist recovery laboratory in an anti-static bag, with a note of the conditions they were found in. Do not power them on.

When imaging fails

Record the failure exactly: tool, version, error text, time, how far it got.
Check the boring causes first: cable, adaptor, power supply, write blocker compatibility, the drive's interface, available space on the destination.
Try a different tool or a different workstation before concluding the source is at fault.
Take the best acquisition you can if a full physical image is impossible: a partial image with a map, a logical copy, or targeted collection of key folders. Document clearly that it is partial and why.

Stop and think

Never "repair" the source drive to make it image. Any repair changes evidence.

Escalate to specialist recovery

Escalate when:

The device is physically damaged.
A drive is deteriorating.
The storage technology is outside your experience: unusual RAID sets, self-encrypting drives, phones that resist standard extraction.
The stakes are high enough that a single failed attempt is unacceptable.

No shame in it

Escalation is not failure. Attempting recovery beyond your competence and destroying the evidence is.

Example

A USB stick from the desk drawer is not recognised by the imaging workstation. The examiner tries a second cable and a second port, records both attempts, photographs the stick and its controller markings, seals it and sends it to a recovery laboratory with the notes. The laboratory reads the flash memory directly. Had the examiner prised the casing open to "check the connection", that outcome would have been in doubt.

Before you move on

No passwords guessed; encryption indicators and prompt text recorded.
Failing or damaged media stopped, photographed and escalated, not retried or powered on.
Any imaging failure recorded with tool, version, error, time and progress.
Partial acquisitions clearly labelled as partial, with the reason.
Nothing on the source repaired, opened or altered to make it image.

← 5. Storage acquisition and integrity All chapters 7. Encryption →

Back to the top of this chapter