恶意样本电子证据保全

---
name: evidence-preservation
description: Preserve digital evidence with forensic integrity using proper chain of custody documentation, cryptographic hashing, forensic imaging, and court-admissible handling procedures.
---

# Evidence Preservation

Preserve digital evidence with forensic integrity for incident response and legal proceedings. This skill covers chain of custody documentation, forensic imaging, hashing, secure handling, and court-admissible documentation practices.

## Prerequisites

- **Python 3.10+** for running the evidence handler scripts
- **dd** / **dc3dd**: Forensic disk imaging tools (dc3dd preferred for built-in hashing)
- **ewfacquire** / **ewfverify**: Expert Witness Format imaging and verification (`libewf`)
- **sha256sum** / **md5sum** / **sha1sum**: Cryptographic hashing utilities
- **7z**: Archive tool for password-protected evidence storage
- **GPG**: For encrypting evidence during transfer
- **OpenSSL**: For creating signed timestamps (optional)

## Steps

### 1. Document Chain of Custody

Every evidence item must have a documented chain of custody recording who handled it, what was done, when, where, and how:

```bash
# Initialize a new evidence case and log the first custody entry
python3 scripts/evidence_handler.py --init-case \
    --case-id "IR-2026-0042" \
    --examiner "Jane Analyst" \
    --description "Ransomware incident on WORKSTATION-15" \
    --output evidence_log.json
```

For each evidence handling action:

```bash
# Log an acquisition event
python3 scripts/evidence_handler.py --log-action \
    --case-id "IR-2026-0042" \
    --evidence-id "EVD-001" \
    --action "acquired" \
    --examiner "Jane Analyst" \
    --description "Created forensic image of WORKSTATION-15 C: drive" \
    --location "Forensics Lab, Room 204" \
    --log evidence_log.json

# Log a transfer event
python3 scripts/evidence_handler.py --log-action \
    --case-id "IR-2026-0042" \
    --evidence-id "EVD-001" \
    --action "transferred" \
    --examiner "Jane Analyst" \
    --recipient "John Forensics" \
    --description "Transferred disk image for deeper analysis" \
    --location "Forensics Lab, Room 204" \
    --log evidence_log.json
```

### 2. Create Forensic Images

Create bit-for-bit forensic images with integrity verification:

```bash
# Using dd (basic, available everywhere)
dd if=/dev/sda of=evidence_disk.raw bs=4096 conv=noerror,sync status=progress

# Using dc3dd (forensic-grade dd with built-in hashing)
dc3dd if=/dev/sda of=evidence_disk.raw hash=sha256 log=imaging.log

# Using ewfacquire (Expert Witness Format - compressed, with metadata)
ewfacquire /dev/sda -t evidence_disk -C "IR-2026-0042" \
    -D "WORKSTATION-15 C: drive" -e "Jane Analyst" \
    -E "Ransomware incident" -f encase6 -S 2G

# Verify image integrity after creation
sha256sum evidence_disk.raw > evidence_disk.raw.sha256
dc3dd if=evidence_disk.raw hash=sha256 vhash=<original_hash>

# Using ewfverify for EWF images
ewfverify evidence_disk.E01
```

### 3. Hash All Evidence Items

Generate and verify cryptographic hashes for every evidence file:

```bash
# Hash a single file with multiple algorithms
python3 scripts/evidence_handler.py --hash \
    --input malware_sample.exe \
    --algorithms md5,sha1,sha256 \
    --output hashes.json

# Hash all files in an evidence directory
python3 scripts/evidence_handler.py --hash-directory \
    --input ./evidence/ \
    --algorithms sha256 \
    --output directory_hashes.json

# Verify hashes against a previous manifest
python3 scripts/evidence_handler.py --verify \
    --input ./evidence/ \
    --manifest directory_hashes.json
```

Manual hashing for verification:

```bash
# Generate hashes
sha256sum evidence_disk.raw
md5sum evidence_disk.raw
sha1sum evidence_disk.raw

# Batch hash all files in a directory
find ./evidence/ -type f -exec sha256sum {} \; > evidence_manifest.sha256

# Verify against manifest
sha256sum -c evidence_manifest.sha256
```

### 4. Handle Malware Samples Safely

Proper procedures for handling malicious evidence:

```bash
# Store sample in password-protected ZIP (standard password: "infected")
7z a -p'infected' -mhe=on evidence_sample.zip malware.exe

# Rename executable extensions to prevent accidental execution
mv malware.exe malware.exe.sample
mv payload.dll payload.dll.sample

# Catalog the sample with metadata
python3 scripts/evidence_handler.py --catalog \
    --input malware.exe.sample \
    --case-id "IR-2026-0042" \
    --evidence-id "EVD-002" \
    --description "Ransomware binary from WORKSTATION-15 Desktop" \
    --source-path "C:\\Users\\victim\\Desktop\\invoice.exe" \
    --tags "ransomware,phishing,initial-access" \
    --output evidence_catalog.json
```

Storage requirements:
- Use encrypted volumes for evidence storage (LUKS, BitLocker, VeraCrypt)
- Maintain at least two copies on separate physical media
- Store original and working copies separately
- Log every access to original evidence

### 5. Timestamp and Integrity Verification

Establish evidence timestamps for legal defensibility:

```bash
# Create a signed timestamp for evidence files
openssl ts -query -data evidence_disk.raw -no_nonce -sha256 \
    -out evidence_disk.tsq
openssl ts -reply -queryfile evidence_disk.tsq -signer tsa_cert.pem \
    -inkey tsa_key.pem -out evidence_disk.tsr

# Alternative: use a public timestamping service
curl -H "Content-Type: application/timestamp-query" \
    --data-binary @evidence_disk.tsq \
    http://timestamp.digicert.com -o evidence_disk.tsr

# Record filesystem timestamps before any modification
stat --format='%n | Access: %x | Modify: %y | Change: %z' /path/to/evidence/*
```

### 6. Legal Considerations

Be aware of jurisdictional requirements:

| Jurisdiction | Key Regulation | Evidence Requirements |
|-------------|----------------|----------------------|
| United States | Federal Rules of Evidence, CFAA | Chain of custody, authentication, best evidence rule |
| European Union | GDPR, ePrivacy Directive | Data minimization, PII handling, cross-border transfer rules |
| United Kingdom | Computer Misuse Act, PACE | ACPO guidelines, imaging standards |
| International | Budapest Convention | Mutual legal assistance, preservation requests |

Key principles:
- **CFAA (US)**: Ensure authorized access to all systems being imaged
- **GDPR (EU)**: Minimize collection of personal data; document lawful basis
- **Best Evidence Rule**: Original evidence or verified exact copies only
- **Admissibility**: Document methodology, tools, and qualifications

### 7. Evidence Labeling and Cataloging

Maintain a systematic evidence catalog:

```bash
# Add evidence item to catalog
python3 scripts/evidence_handler.py --catalog \
    --input evidence_disk.E01 \
    --case-id "IR-2026-0042" \
    --evidence-id "EVD-001" \
    --description "Forensic image of WORKSTATION-15 system drive" \
    --examiner "Jane Analyst" \
    --tags "disk-image,workstation,ransomware" \
    --output evidence_catalog.json

# Generate evidence inventory report
python3 scripts/evidence_handler.py --inventory \
    --catalog evidence_catalog.json \
    --format markdown
```

Labeling convention:
```
Evidence ID:   EVD-<case_number>-<sequence>
Example:       EVD-IR2026042-001
Label format:  <CaseID> | <EvidenceID> | <Description> | <Date> | <Examiner>
```

### 8. Secure Evidence Transfer

Protocols for transferring evidence between parties:

```bash
# Encrypt evidence for transfer
gpg --output evidence_package.gpg --encrypt --recipient analyst@example.com \
    evidence_archive.tar.gz

# Create a transfer manifest with hashes
python3 scripts/evidence_handler.py --transfer-manifest \
    --input evidence_package.gpg \
    --sender "Jane Analyst" \
    --recipient "John Forensics" \
    --case-id "IR-2026-0042" \
    --output transfer_manifest.json

# Verify received evidence against manifest
python3 scripts/evidence_handler.py --verify-transfer \
    --input evidence_package.gpg \
    --manifest transfer_manifest.json
```

Transfer checklist:
- Encrypt all evidence in transit (GPG, age, or equivalent)
- Generate hash manifest before transfer
- Recipient verifies hashes immediately upon receipt
- Both parties log the transfer in chain of custody
- Use secure channels (SFTP, physical hand-off with signed receipt)
- Never transfer evidence over unencrypted channels

## Output Format

```json
{
  "case_id": "IR-2026-0042",
  "evidence_catalog": [
    {
      "evidence_id": "EVD-001",
      "description": "Forensic image of WORKSTATION-15 system drive",
      "type": "disk_image",
      "format": "E01",
      "file_path": "/evidence/IR-2026-0042/EVD-001/evidence_disk.E01",
      "hashes": {
        "md5": "d41d8cd98f00b204e9800998ecf8427e",
        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
        "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      },
      "size_bytes": 53687091200,
      "acquired": "2026-03-21T14:30:00Z",
      "examiner": "Jane Analyst",
      "source": "WORKSTATION-15, /dev/sda",
      "tags": ["disk-image", "workstation", "ransomware"]
    }
  ],
  "chain_of_custody": [
    {
      "timestamp": "2026-03-21T14:30:00Z",
      "evidence_id": "EVD-001",
      "action": "acquired",
      "examiner": "Jane Analyst",
      "location": "Forensics Lab, Room 204",
      "description": "Created forensic image of WORKSTATION-15 C: drive",
      "hash_verified": true
    },
    {
      "timestamp": "2026-03-21T16:45:00Z",
      "evidence_id": "EVD-001",
      "action": "transferred",
      "examiner": "Jane Analyst",
      "recipient": "John Forensics",
      "location": "Forensics Lab, Room 204",
      "description": "Transferred disk image for deeper analysis"
    }
  ],
  "integrity_status": "verified",
  "total_evidence_items": 1
}
```

## Tips

- Always hash evidence immediately upon acquisition, before any analysis begins
- Use at least two hash algorithms (SHA-256 is the standard; include MD5 for backward compatibility with older tools)
- Never work directly on original evidence; always create and analyze working copies
- Document your tools and their versions (e.g., "dc3dd version 7.2.646, ewfacquire 20171104") for reproducibility
- Set your analysis system clock to UTC and verify accuracy before timestamping evidence
- For volatile evidence (RAM, network captures), acquire in order of volatility: registers, cache, RAM, disk, logs
- Keep a detailed lab notebook or digital log of every action taken during evidence handling
- If you discover evidence outside the original scope, stop and document the finding before proceeding — expanding scope may require additional authorization
- Regularly verify evidence integrity by rechecking hashes against the original manifest
- Store chain-of-custody logs separately from the evidence itself to prevent circular dependency