Digital Forensics · 4 min
Evidence Integrity & Chain of Custody
Why how you handle evidence changes what it can prove
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Acquisition vs analysis
Acquisition is capturing the evidence. Analysis is asking questions of it. Keeping them separate is what lets you re-run analysis later without touching the original.
- Acquire once, carefully, with as little change as practical
- Analyse a working copy, never the original where it can be avoided
- Record the tools, versions and times used at each stage
Hashing as an integrity check
A cryptographic hash is a fixed-length fingerprint of data. Hash at acquisition, hash again later, and compare: identical values are strong support that the data did not change between those two points.
- Same hash → the data matches the earlier capture
- Different hash → something changed; find out what and when
- Use a current algorithm; older ones have known collision weaknesses
Loading the interactive lesson…