From the Anglo-American common-law rules for authenticating evidence, codified in Federal Rules of Evidence 901 and 902 (1975), and extended to digital evidence by Karen Kent, Suzanne Chevalier, Tim Grance, and Hung Dang (Guide to Integrating Forensic Techniques into Incident Response, 2006).
Keeps an unbroken log of everyone who handled a piece of evidence, with what they did, when, and where, so findings can show the evidence is unaltered.
When to reach for it
When an investigation, fraud review, or incident analysis will be challenged, and its conclusions must survive legal or regulatory scrutiny.
How it runs
- Prepare logs, labels, sealed containers, and imaging tools before collecting.
- Record source, time, collector, and witnesses at collection.
- Image digital evidence, record its hash, and work only from copies.
- Log every transfer with who, what, when, where, and why.
- Recheck hashes and seals before and after each analysis.
Where it sits in SOLVE eX
Go to the source
- Guide to Integrating Forensic Techniques into Incident Response, NIST Special Publication 800-86, 2006
- Federal Rules of Evidence, Rules 901 and 902, 1975