--- name: evidence-preservation description: Preserve digital evidence with forensic integrity using proper chain of custody documentation, cryptographic hashing, forensic imaging, and court-admissible handling procedures. --- # Evidence Preservation Preserve digital evidence with forensic integrity for incident response and legal proceedings. This skill covers chain of custody documentation, forensic imaging, hashing, secure handling, and court-admissible documentation practices. ## Prerequisites - **Python 3.10+** for running the evidence handler scripts - **dd** / **dc3dd**: Forensic disk imaging tools (dc3dd preferred for built-in hashing) - **ewfacquire** / **ewfverify**: Expert Witness Format imaging and verification (`libewf`) - **sha256sum** / **md5sum** / **sha1sum**: Cryptographic hashing utilities - **7z**: Archive tool for password-protected evidence storage - **GPG**: For encrypting evidence during transfer - **OpenSSL**: For creating signed timestamps (optional) ## Steps ### 1. Document Chain of Custody Every evidence item must have a documented chain of custody recording who handled it, what was done, when, where, and how: ```bash # Initialize a new evidence case and log the first custody entry python3 scripts/evidence_handler.py --init-case \ --case-id "IR-2026-0042" \ --examiner "Jane Analyst" \ --description "Ransomware incident on WORKSTATION-15" \ --output evidence_log.json ``` For each evidence handling action: ```bash # Log an acquisition event python3 scripts/evidence_handler.py --log-action \ --case-id "IR-2026-0042" \ --evidence-id "EVD-001" \ --action "acquired" \ --examiner "Jane Analyst" \ --description "Created forensic image of WORKSTATION-15 C: drive" \ --location "Forensics Lab, Room 204" \ --log evidence_log.json # Log a transfer event python3 scripts/evidence_handler.py --log-action \ --case-id "IR-2026-0042" \ --evidence-id "EVD-001" \ --action "transferred" \ --examiner "Jane Analyst" \ --recipient "John Forensics" \ --description "Transferred disk image for deeper analysis" \ --location "Forensics Lab, Room 204" \ --log evidence_log.json ``` ### 2. Create Forensic Images Create bit-for-bit forensic images with integrity verification: ```bash # Using dd (basic, available everywhere) dd if=/dev/sda of=evidence_disk.raw bs=4096 conv=noerror,sync status=progress # Using dc3dd (forensic-grade dd with built-in hashing) dc3dd if=/dev/sda of=evidence_disk.raw hash=sha256 log=imaging.log # Using ewfacquire (Expert Witness Format - compressed, with metadata) ewfacquire /dev/sda -t evidence_disk -C "IR-2026-0042" \ -D "WORKSTATION-15 C: drive" -e "Jane Analyst" \ -E "Ransomware incident" -f encase6 -S 2G # Verify image integrity after creation sha256sum evidence_disk.raw > evidence_disk.raw.sha256 dc3dd if=evidence_disk.raw hash=sha256 vhash= # Using ewfverify for EWF images ewfverify evidence_disk.E01 ``` ### 3. Hash All Evidence Items Generate and verify cryptographic hashes for every evidence file: ```bash # Hash a single file with multiple algorithms python3 scripts/evidence_handler.py --hash \ --input malware_sample.exe \ --algorithms md5,sha1,sha256 \ --output hashes.json # Hash all files in an evidence directory python3 scripts/evidence_handler.py --hash-directory \ --input ./evidence/ \ --algorithms sha256 \ --output directory_hashes.json # Verify hashes against a previous manifest python3 scripts/evidence_handler.py --verify \ --input ./evidence/ \ --manifest directory_hashes.json ``` Manual hashing for verification: ```bash # Generate hashes sha256sum evidence_disk.raw md5sum evidence_disk.raw sha1sum evidence_disk.raw # Batch hash all files in a directory find ./evidence/ -type f -exec sha256sum {} \; > evidence_manifest.sha256 # Verify against manifest sha256sum -c evidence_manifest.sha256 ``` ### 4. Handle Malware Samples Safely Proper procedures for handling malicious evidence: ```bash # Store sample in password-protected ZIP (standard password: "infected") 7z a -p'infected' -mhe=on evidence_sample.zip malware.exe # Rename executable extensions to prevent accidental execution mv malware.exe malware.exe.sample mv payload.dll payload.dll.sample # Catalog the sample with metadata python3 scripts/evidence_handler.py --catalog \ --input malware.exe.sample \ --case-id "IR-2026-0042" \ --evidence-id "EVD-002" \ --description "Ransomware binary from WORKSTATION-15 Desktop" \ --source-path "C:\\Users\\victim\\Desktop\\invoice.exe" \ --tags "ransomware,phishing,initial-access" \ --output evidence_catalog.json ``` Storage requirements: - Use encrypted volumes for evidence storage (LUKS, BitLocker, VeraCrypt) - Maintain at least two copies on separate physical media - Store original and working copies separately - Log every access to original evidence ### 5. Timestamp and Integrity Verification Establish evidence timestamps for legal defensibility: ```bash # Create a signed timestamp for evidence files openssl ts -query -data evidence_disk.raw -no_nonce -sha256 \ -out evidence_disk.tsq openssl ts -reply -queryfile evidence_disk.tsq -signer tsa_cert.pem \ -inkey tsa_key.pem -out evidence_disk.tsr # Alternative: use a public timestamping service curl -H "Content-Type: application/timestamp-query" \ --data-binary @evidence_disk.tsq \ http://timestamp.digicert.com -o evidence_disk.tsr # Record filesystem timestamps before any modification stat --format='%n | Access: %x | Modify: %y | Change: %z' /path/to/evidence/* ``` ### 6. Legal Considerations Be aware of jurisdictional requirements: | Jurisdiction | Key Regulation | Evidence Requirements | |-------------|----------------|----------------------| | United States | Federal Rules of Evidence, CFAA | Chain of custody, authentication, best evidence rule | | European Union | GDPR, ePrivacy Directive | Data minimization, PII handling, cross-border transfer rules | | United Kingdom | Computer Misuse Act, PACE | ACPO guidelines, imaging standards | | International | Budapest Convention | Mutual legal assistance, preservation requests | Key principles: - **CFAA (US)**: Ensure authorized access to all systems being imaged - **GDPR (EU)**: Minimize collection of personal data; document lawful basis - **Best Evidence Rule**: Original evidence or verified exact copies only - **Admissibility**: Document methodology, tools, and qualifications ### 7. Evidence Labeling and Cataloging Maintain a systematic evidence catalog: ```bash # Add evidence item to catalog python3 scripts/evidence_handler.py --catalog \ --input evidence_disk.E01 \ --case-id "IR-2026-0042" \ --evidence-id "EVD-001" \ --description "Forensic image of WORKSTATION-15 system drive" \ --examiner "Jane Analyst" \ --tags "disk-image,workstation,ransomware" \ --output evidence_catalog.json # Generate evidence inventory report python3 scripts/evidence_handler.py --inventory \ --catalog evidence_catalog.json \ --format markdown ``` Labeling convention: ``` Evidence ID: EVD-- Example: EVD-IR2026042-001 Label format: | | | | ``` ### 8. Secure Evidence Transfer Protocols for transferring evidence between parties: ```bash # Encrypt evidence for transfer gpg --output evidence_package.gpg --encrypt --recipient analyst@example.com \ evidence_archive.tar.gz # Create a transfer manifest with hashes python3 scripts/evidence_handler.py --transfer-manifest \ --input evidence_package.gpg \ --sender "Jane Analyst" \ --recipient "John Forensics" \ --case-id "IR-2026-0042" \ --output transfer_manifest.json # Verify received evidence against manifest python3 scripts/evidence_handler.py --verify-transfer \ --input evidence_package.gpg \ --manifest transfer_manifest.json ``` Transfer checklist: - Encrypt all evidence in transit (GPG, age, or equivalent) - Generate hash manifest before transfer - Recipient verifies hashes immediately upon receipt - Both parties log the transfer in chain of custody - Use secure channels (SFTP, physical hand-off with signed receipt) - Never transfer evidence over unencrypted channels ## Output Format ```json { "case_id": "IR-2026-0042", "evidence_catalog": [ { "evidence_id": "EVD-001", "description": "Forensic image of WORKSTATION-15 system drive", "type": "disk_image", "format": "E01", "file_path": "/evidence/IR-2026-0042/EVD-001/evidence_disk.E01", "hashes": { "md5": "d41d8cd98f00b204e9800998ecf8427e", "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, "size_bytes": 53687091200, "acquired": "2026-03-21T14:30:00Z", "examiner": "Jane Analyst", "source": "WORKSTATION-15, /dev/sda", "tags": ["disk-image", "workstation", "ransomware"] } ], "chain_of_custody": [ { "timestamp": "2026-03-21T14:30:00Z", "evidence_id": "EVD-001", "action": "acquired", "examiner": "Jane Analyst", "location": "Forensics Lab, Room 204", "description": "Created forensic image of WORKSTATION-15 C: drive", "hash_verified": true }, { "timestamp": "2026-03-21T16:45:00Z", "evidence_id": "EVD-001", "action": "transferred", "examiner": "Jane Analyst", "recipient": "John Forensics", "location": "Forensics Lab, Room 204", "description": "Transferred disk image for deeper analysis" } ], "integrity_status": "verified", "total_evidence_items": 1 } ``` ## Tips - Always hash evidence immediately upon acquisition, before any analysis begins - Use at least two hash algorithms (SHA-256 is the standard; include MD5 for backward compatibility with older tools) - Never work directly on original evidence; always create and analyze working copies - Document your tools and their versions (e.g., "dc3dd version 7.2.646, ewfacquire 20171104") for reproducibility - Set your analysis system clock to UTC and verify accuracy before timestamping evidence - For volatile evidence (RAM, network captures), acquire in order of volatility: registers, cache, RAM, disk, logs - Keep a detailed lab notebook or digital log of every action taken during evidence handling - If you discover evidence outside the original scope, stop and document the finding before proceeding — expanding scope may require additional authorization - Regularly verify evidence integrity by rechecking hashes against the original manifest - Store chain-of-custody logs separately from the evidence itself to prevent circular dependency