Internship
Student login
← Digital Forensics learning path
Digital Forensics · Module 3 of 10

Evidence handling and chain of custody

Keep evidence trustworthy from seizure to court.

📖 Key ideas

  1. Chain of custody records who handled evidence, when and why.
  2. Label, seal and store evidence securely.
  3. Use write blockers to prevent changes when reading disks.
  4. Hash values (SHA-256) prove copies match originals.
  5. Any gap in custody can weaken a case.
💡 Real-life example: Chain of custody is a courier tracking log: every handover is signed and timed.
Chain of custodyRecord of evidence handling
Write blockerDevice preventing writes to evidence
Hash valueDigital fingerprint of data
Evidence bagSealed container for items