Digital Evidence Collection & Preservation

Why digital evidence is harder than it looks

Pick up a gun with gloved hands, bag it, log it. The gun does not change. Digital evidence? Different animal. Open the wrong file on a suspect's computer and you just changed three timestamps. Image a drive without write-blocking and you altered who knows what. Take a screenshot without documenting how you got it and watch opposing counsel dismantle your case.

Courts get this now. Judges have seen enough botched digital cases to know when you skipped steps. Miss a hash verification or leave a gap in your chain of custody logs and you will spend an uncomfortable hour on the stand explaining why your six-month investigation should not be thrown out.

This guide covers what works in court. Not theory, not aspirational best practices nobody follows. The stuff that actually holds up when defense counsel starts asking technical questions. Law enforcement, corporate investigators, civil litigators, compliance auditors all face the same problems. Get the evidence, prove it's real, prove you did not mess with it.

What courts actually care about

Five things will make or break your digital evidence. Get all five right, you are solid. Miss one, expect problems.

Authenticity

Prove the evidence is what you say it is. Screenshots can be Photoshopped. Emails can be spoofed. You need hash values, metadata, timestamps, or someone who can testify "yes, I saw this on the defendant's phone at 3 PM on Tuesday."

Integrity

Prove nothing changed between collection and trial. Hash the drive when you seize it. Hash it again before court. Hashes match? You are good. Hashes differ? Start explaining why you should still have a job.

Reliability

Use tools the forensic community trusts. EnCase, FTK, Cellebrite have decades of court acceptance. Your custom Python script from GitHub? Prepare for a long cross-examination about validation and error rates. Certifications help too. EnCE, GCFE, CCE mean you followed somebody's standards besides your own.

Admissibility

Fit the evidence into the rules. Federal Rules of Evidence apply in federal court. Most states copied them. You will spend time on FRE 901 (authentication) and FRE 803(6) (business records exception to hearsay). If these codes mean nothing to you, talk to a prosecutor before you get on the stand.

Preservation

Keep it safe. Physical drives go in evidence lockers. Digital files get encrypted, backed up, and access-logged. Retention depends on the case type. Criminal? Keep it until appeals run out, sometimes 20 years. Civil? Seven to ten years after judgment. Lose evidence because you ran out of hard drive space? Good luck explaining that.

Chain of custody will kill you if you skip it

Who had the evidence, when, where, doing what. Document every transfer. Every person who touched it. Every time someone opened a file to examine it.

Laptop in Detective Rodriguez's desk Monday, Analyst Chen's lab Wednesday. Nothing logged Tuesday. Defense will argue someone had 24 hours to plant files. Judge might toss the whole case. I have seen this happen.

What to write down

• Who handled it (full name, badge number)
• What exactly it is ("iPhone 12, serial ABC123, 128GB, black case" not "phone")
• When (actual timestamps, not "afternoon")
• Where (evidence room #5, lab bench 3, courtroom 2A)
• Why (imaging, analysis, court transport)
• Condition (powered on, in Faraday bag, sealed in anti-static packaging)

Mistakes I keep seeing

Forms filled out three days later when someone remembers. "Computer stuff" as the description. No signatures. Time gaps nobody can explain. Each one is a gift to defense counsel. Do not make their job easier.

Hash values are your best friend

Think of a hash as a fingerprint for data. Change one byte in a 500GB drive and the hash changes completely. This is how you prove nobody messed with your evidence.

Seize a laptop. Run SHA-256 on the drive. You get a 64-character string. Write it in your report. Two months later before trial, hash it again. Same string? Nothing changed. Different string? Time to figure out what happened and document it before the prosecutor finds out.

Which algorithm

SHA-256 minimum. SHA-512 if you are paranoid or the case will sit in storage for years. MD5 and SHA-1 are dead. Courts know they are broken. Using them makes you look behind the times.

When to hash

Right after seizure. Before you touch anything. After copying to your analysis machine. Before court. Before and after sending drives between agencies. Any time someone might claim tampering, a matching hash shuts them up.

Write-block everything or explain why you didn't

Plug a suspect drive into your Windows laptop without write-blocking. Windows immediately starts writing: timestamps change, index files get created, temp files appear. You just altered evidence. Defense will ask why you contaminated the drive before imaging it. Your answer better be good.

Hardware write-blockers sit between the drive and your machine. Tableau and WiebeTech are the standard brands. They block all write commands physically. Courts trust them. Software write-blockers (FTK Imager has one built-in) work at the OS level. Cheaper, riskier. I use hardware for anything serious.

Why copying files is not enough

Drag-and-drop file copying misses everything interesting. Deleted files? Gone. Slack space? Ignored. Unallocated clusters with fragments of old data? Not copied. You just threw away half your evidence.

Forensic imaging copies every bit on the drive. Empty space, deleted files, system partitions, all of it. Use FTK Imager, EnCase, or dd if you are on Linux. Hash the original. Hash the image. Match? You have an exact copy.

E01 format is standard for law enforcement. Adds compression and metadata. Raw dd images are simpler but huge. Use whatever your lab uses and write the format in your report.

What to do with different evidence types

Hard drives and SSDs

Power it down if you can (stops auto-encrypt and remote wipe). Take the whole computer or pull the drive. Write down make, model, serial, capacity. Image it with a write-blocker. Hash it. Lock the original in evidence storage. Work from the image only.

Phones and tablets

Airplane mode or Faraday bag right away. Remote wipe commands can come in fast. Do not turn it off. Modern phones encrypt on power-down and you might not get back in. Document IMEI, serial, phone number, carrier. Cellebrite and GrayKey are the main extraction tools. Logical extraction (file system) is faster. Physical (bit-level) is better but encryption makes it harder.

Cloud accounts

Send a preservation letter to Google, Microsoft, Meta, whoever, today. They delete old data on schedules (90 to 180 days usually). Then get your warrant or subpoena for the actual content. Each provider has its own process. Document everything. Hash the downloaded files.

Social media posts

Screenshots are a start. Include the URL, date, time, username in the frame. Better: use the Forensic OSINT Extension to capture the full page with HTML source, metadata, and cryptographic timestamps. Posts get deleted. Accounts disappear. The Forensic OSINT Extension automatically archives content with tamper-proof verification and generates court-ready reports with complete chain of custody documentation.

Emails

Get the full email with headers. Headers have routing info, sender IP, SPF/DKIM authentication. Export as .eml or .msg format. Not PDF. PDF strips out the metadata you need. Email headers prove the message is real or show it's spoofed.

Network logs

Firewall logs, router logs, web server logs, IDS logs. Grab them fast before log rotation deletes them. Convert all timestamps to UTC so you can line up events from different systems. Hash the log files as soon as you get them.

What defense will say and how to answer

"This screenshot is fake"

Could be. So authenticate it. Testify you took it personally. Show the file metadata (when created, what device). Point to other evidence that matches (more screenshots, archived versions). Use Forensic OSINT for online content capture with embedded cryptographic timestamps, and document your collection process in Forensic Notes for contemporaneous chain of custody records. Judges like authenticated captures with documented procedures better than bare screenshots.

"How do we know the hash is right?"

Walk through your process. Tool used (FTK Imager 4.7.1), algorithm (SHA-256), original hash, verification hash. Explain it like a fingerprint: "Change one letter in this document and the fingerprint changes. These two fingerprints match, so nothing changed." Judges get it.

"You contaminated the evidence"

Show the write-blocker. Photos help. Logs from your imaging software showing read-only mode. Hashes before and after imaging that match. Write-blocking is expected. Skip it and you will explain why for a long time.

"You did not follow standards"

Show your certs (GCFE, EnCE, CCE). Point to the standards you followed (NIST, SWGDE, ASTM). Walk through your notes documenting each step. Courts trust certified people who followed published procedures. Improvise at your own risk.

The short version

Chain of custody with no gaps. Hash everything (SHA-256 or SHA-512). Write-block all imaging. Make forensic images, not file copies. Photo the scene before you touch anything. Send cloud preservation letters same day. Lock evidence in secure storage with backups. Use tools courts know (FTK, EnCase, Cellebrite). Get certified if you plan to testify regularly (GCFE, EnCE, CCE). Follow NIST and SWGDE standards so you can point to them when questioned.

Related Resources

DFIR Tools:Hash Calculator | Timestamp Decoder | IMAGE EXIF Analyzer | All Tools

OSINT & Cyber Tools:IP Lookup | Username Search | Email Header Analyzer | More OSINT Tools