EnCE · Domain 1
Forensic Methodology and Evidence Handling
About 14% of the exam
Examination method
- Define the question
- Preserve the source
- Examine a copy
- Test the hypothesis
- Corroborate
- Report
- Scope comes from the authorization
- Preserve before you explore
- Every step must be repeatable
- Look for evidence that refutes you
- Absence of contradiction is not proof
Write down why each step exists, so an examiner facing an unplanned situation can still apply judgment
Chain of custody entries
- Item identifier
- unique tag per evidence item
- Received from
- who handed it over and when
- Purpose
- why the item moved or opened
- Courier
- transit holders belong on the record
- Storage location
- where it rests between actions
- Return or destruction
- closing entry with authority cited
Any unexplained interval in the record is the gap opposing counsel will spend the day on
Scene documentation
- Photograph the layout before touching anything
- Label cables and ports before disconnecting
- Record device state, on, off or sleeping
- Note screen contents and running applications
- List who was present at the scene
- Record items considered and deliberately not seized
Volatility in practice
- Memory contents
- gone the moment power drops
- Network state
- connections and address cache
- Running processes
- handles and loaded modules
- Temporary storage
- cleared by reboot or cleanup
- Local disk
- persistent, image it later
- Backups and archives
- least volatile, longest reachable
Packaging and storage
Package
- One item per sealed container
- Tamper evident seal, signed and dated
- Antistatic protection for bare media
- Shielded bags for radio capable devices
Store
- Restricted room with logged access
- Tighter controls for active litigation
- Stable temperature and humidity
- Separate active cases from closed ones
Move
- Hash before and after transport
- Record the courier on the form
- Inspect seals on arrival
- Photograph any damage found
Separate packaging keeps each item's history distinct and stops two exhibits becoming one argument
Integrity by hashing
- Hash the source before acquisition
- Hash the image after acquisition
- Re-hash after analysis to show no change
- Prefer cryptographic hashes over simple checksums
- Record the algorithm alongside the value
- Investigate a mismatch, never bury it
Authority and scope
- Record the warrant number or consent form
- Note any time period the authority limits
- Stop when a finding falls outside scope
- Seek expanded authority before continuing
- Consent can be narrowed or withdrawn
- Employer policy underpins workplace examinations
Working practices
- Examine copies, never the original
- Use validated tools with recorded versions
- Keep contemporaneous notes as you work
- Rely on tool logs as well as notes
- Two examiners for high stakes acquisitions
- Pause when the item does not match its tag
Objectivity failures
- Confirmation bias
- looking only for supporting evidence
- Scope creep
- searching beyond the authorization
- Single source finding
- no independent corroboration attempted
- Overstated certainty
- inference presented as observation
- Unrecorded action
- step performed but never documented
- Self review only
- no second examiner ever checked
Legal hold and preservation
Trigger
- Litigation reasonably anticipated
- Regulatory or internal investigation opened
- Departure of a relevant custodian
- Notice received from another party
Act
- Suspend automatic deletion immediately
- Notify custodians in writing
- Preserve devices before reissue
- Capture cloud and mailbox data
Prove
- Document each preservation step taken
- Track acknowledgment from custodians
- Record what could not be preserved
- Review the hold periodically
Issuing a hold is not preservation; the documentation of what was actually preserved is the defense
Cross border matters
- Data location decides the applicable law
- Formal channels move evidence between states
- Providers answer to their own jurisdiction
- Informal collection can spoil the evidence
- Consult counsel before touching foreign data
- Privacy rules may limit export
Disposal and return
- Return needs date, recipient and condition
- Cite the authority for the release
- Destruction is witnessed and documented
- Retain the verified image after return
- Close the custody record explicitly
- Follow the retention schedule for case files
Know the order
- Confirm authority
- Document the scene
- Collect by volatility
- Seal and log
- Image and hash
- Examine the copy
Authority, documentation, volatility, verification: the sequence is examinable in its own right
Rapid recall
- Forensic soundness
- original unaltered, process documented and repeatable
- Custody continuity
- no unexplained gap in possession
- Working copy
- verified duplicate used for analysis
- Tamper evident seal
- shows whether a container was opened
- Legal hold
- suspend deletion of relevant material
- Spoliation
- loss of evidence you had to keep
- Peer review
- second examiner checks the findings
Reference strip: handling essentials
Documentation
- Scene photographs and diagrams
- Evidence inventory with exclusions
- Custody form for every transfer
- Contemporaneous examiner notes
Integrity
- Hash at source and image
- Re-hash after analysis
- Write protection during acquisition
- Sealed storage with logged access
Authority
- Warrant scope and time limits
- Consent with authority and limits
- Workplace policy and notice
- Formal cross border channels
Volatility order
- Memory and running state
- Network connections and caches
- Temporary files and caches
- Disk, then backups
Quality
- Validated tools and versions
- Two examiners when stakes are high
- Independent peer review
- Documented deviations from procedure
Quick exam traps
- Trap: A courier does not belong on the custody record
- Trap: Intact seals make a documentation gap harmless
- Trap: The examiner who images the drive can review their own work
- Trap: Finding nothing that contradicts a theory proves the theory
- Trap: Correcting a mismatched evidence tag on the spot is fine
- Trap: Issuing a legal hold is enough to prove preservation
- Trap: Original media can be discarded once the image verifies
cybercertprep.com · original revision sheet written from the public body of knowledge