Chain of Custody
After you understand how to identify computer evidence and you know what equipment you can access, you are ready to begin collecting evidence. The steps you take during the collection process determine whether that evidence will be useful once the investigation is completed. You must ensure that your evidence has been acquired properly and remains pristine. This section discusses several concepts necessary to ensure that collected evidence remains valid for later use.
Definition
chain of custody
Documentation of all steps that evidence has taken from the time it is located at a crime scene to the time it’s introduced in a courtroom. All steps include collection, transportation, analysis, and storage processes. All accesses to ...
Get Computer Forensics JumpStart, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
