Forensic Imaging & Chain of Custody

Copying files reproduces the files a filesystem chooses to show you. A forensic image captures the storage medium itself, including unallocated space, file slack, and deleted content that no longer appears in any directory listing — plus the metadata that establishes when files were created, modified, and accessed. Copying also updates access timestamps on the source, altering the very evidence you are trying to preserve. That difference is usually where a case is won or lost: the deleted file and the timestamp are frequently the proof.

A write blocker sits between the examiner's system and the source media and physically or logically prevents any write operation reaching it. Without one, simply attaching a drive to a running computer can cause the operating system to write to it — mounting volumes, updating timestamps, creating recovery files. Any of those changes the hash, and a changed hash invites the argument that the examiner altered the evidence. Using a write blocker, and documenting that you did, removes the argument.

A hash function reduces the entire contents of a drive to a fixed-length value, and changing a single bit produces a completely different value. We compute a hash at acquisition, re-verify it after imaging, and re-verify again whenever a working copy is made. When those values match, an examiner can state that the image analyzed in the lab is identical to what was acquired from the device — and that statement is checkable by anyone with the same image.

A gap does not automatically make evidence inadmissible, but it shifts the argument from what the evidence shows to whether it can be trusted, and it is the first place a competent opposing expert will probe. Courts weigh the gap against the other indicia of reliability, and a verified hash can go a long way toward closing it. The practical answer is that an unbroken, contemporaneous record costs very little to maintain and is expensive to reconstruct after the fact.

Often, but the result differs. A physical image of an encrypted drive without the key yields ciphertext, which preserves the data but cannot be analyzed. Where credentials or keys are available we acquire in a decrypted state; where they are not, we may perform a live or logical acquisition from the running system. Each approach captures a different scope, and we document which was used and what it excludes rather than presenting a logical acquisition as a full physical image.

Cloud evidence lives on infrastructure you cannot touch, so preservation shifts from imaging hardware to controlling and documenting the export. We use the provider's supported collection paths, capture the server-side metadata that evidences completeness, record the exact query parameters and date ranges used, and hash the resulting export. The defensibility comes from reproducibility: another examiner running the same request should obtain the same set.

Federal Rule of Evidence 901(b)(9) allows authentication by describing a process or system and showing it produces an accurate result — which is what a documented imaging methodology is. Rule 902(14) goes further, letting data copied from an electronic device be self-authenticating when it is identified by a hash and certified by a qualified person, which can remove the need for live foundation testimony entirely. Both depend on having done the acquisition properly and written it down at the time.