What is chain of custody?
When a security incident might lead to someone being fired, a lawsuit or criminal charges, the evidence has to be trustworthy. Chain of custody is how an organization shows that the hard drive, phone, USB stick or log file presented later is the same item that was collected, and that no one altered it along the way. Every transfer is recorded, from the first person who secured the item to the investigator, the evidence locker and beyond. A gap, such as a drive left on a desk overnight with no record of who had access, gives the other side a reason to question the evidence and can make it much less useful.
What a custody record captures
- What: a description of the item with unique identifiers such as make, model, serial number, asset tag and case number.
- Who: the person releasing the item and the person receiving it, with both signatures at every handoff.
- When: the date and time of each collection, transfer and examination.
- Where: where the item was found and where it is stored.
- Why: the reason for each transfer and any action taken, such as imaging or sealing.
- Integrity details: seal numbers and the hash values of any forensic images.
How evidence is handled
- Photograph first: record the screen, cables and physical setup before touching anything.
- Label: give each item a unique ID tied to the case.
- Seal: place items in tamper-evident bags or containers, signed and dated across the seal.
- Store securely: keep evidence in a locked, access-controlled location and log every access.
- Work on a copy: analysts make a forensic (bit-for-bit) image of the drive through a write blocker, a device that allows reads but blocks writes. Unlike a normal file copy, the image includes deleted data in unallocated space and slack space.
- Hash: a cryptographic hash such as SHA-256 is calculated for the original and the image. Matching values prove the copy is exact, and hashing again later proves nothing has changed since collection.
Order of volatility
Some evidence disappears faster than other evidence, so investigators collect the most volatile data first: CPU registers and cache, then memory contents such as running processes and network connections, then temporary files and swap space, then data on disk, then remote logs, and finally backups and archives. Shutting a machine down destroys everything in RAM. That is why a technician should not power off or reboot a system that may hold evidence unless the incident response policy or the investigators say to.
Chain of custody vs normal IT work
| Routine IT habit | Why it is a problem with evidence |
|---|---|
| Rebooting to "see if it helps" | Wipes memory and changes logs and timestamps |
| Opening or copying files by drag and drop | Changes access times and misses deleted data |
| Running disk repair or an antivirus scan | Writes to the disk and can overwrite recoverable data |
| Handing the laptop to a coworker | Creates an undocumented transfer, which breaks the chain |
The A+ technician's role is to preserve, secure and document, then hand over to trained staff, signing the custody form at each transfer. Forensic analysis itself is a specialist job.
Chain of custody on the CompTIA A+ exam
Core 2 (220-1202) objective 4.6 covers incident handling, including chain of custody, preserving data and devices, and documentation. If a question asks how to prove evidence was not tampered with, think chain of custody backed by hash values. If it asks what to do when handing a seized drive to someone else, think document the transfer and have both parties sign. If it asks how to copy a drive for analysis, think forensic image through a write blocker, not a normal file copy. If a scenario describes evidence left unattended or passed around without a record, the chain of custody is broken.