Preserving Evidence: Imaging, Write Blockers, Hashes and Chain of Custody

What you'll be able to do

You will be able to explain how investigators copy and protect evidence so that it can be trusted in court.

• Tell a logical copy from a full forensic image, and say why the image matters.
• Explain what a write blocker, a hash and a chain of custody each prove.
• Explain why investigators sometimes leave a running computer switched on.

In Lesson 6.1 you kept personal evidence — screenshots, messages and a log. This lesson is the professional level: how investigators preserve evidence so that someone else, perhaps years later, can check that nothing was changed.

Rule one: never work on the original

Digital evidence is fragile. Simply opening a file or starting a computer can change dates, logs and free space. So investigators follow one rule above all: copy the evidence in a way that does not change it, then work only on the copy. The original is stored safely so it can be re-checked later.

Logical copy or full image?

There are two very different ways to copy a drive:

• A logical copy copies the visible folders and files — like a normal backup. It misses deleted files, slack space and free space, which is where much of the evidence from Lesson 6.3 hides.
• A bit-stream image (also called a forensic image) copies the entire storage medium, bit for bit, including free and slack space. It takes longer and needs more storage, but it captures everything and keeps original file names and times.

Dr. Al-Doori's book recommends the bit-stream image, and that is still core practice.

Write blockers: read, never write

When an evidence drive is connected to an investigator's computer, that computer might try to write to it automatically — for example, to update a timestamp. A write blocker prevents this. It is a hardware device, or software, that sits between the evidence drive and the investigator's computer and lets data be read but never written. Careful investigators test their write blocker on a spare drive before connecting real evidence.

Hashes: a fingerprint for data

A hash is a short, fixed-length value calculated from data by a mathematical function. You met hashes in Lesson 4.1, where they protect passwords. Here they act as a fingerprint: change even a single bit of the data and the hash comes out completely different.

The process works like this:

1. When the image is made, the investigator calculates the hash of the original and of the copy, and records both. They should match.
2. Later — in the lab, or years later in court — anyone can calculate the hash again.
3. If it still matches, the copy has not changed since it was hashed.

Notice the exact limit: a matching hash proves the data has not changed since the moment it was hashed. It proves nothing about what happened before the evidence was collected, and nothing about who created the files.

Which hash? The book describes MD5, which produces 32 hexadecimal characters, and SHA-1, which produces 40. Both were standard for years. Today, SHA-256 (64 hexadecimal characters) is the sensible default. Researchers produced the first practical SHA-1 collision — two different files with the same hash — in 2017 (the "SHAttered" project), and MD5 collisions have been practical for even longer. NIST is retiring SHA-1 for all uses by 31 December 2030. For new forensic workflows, SHA-256 or another SHA-2/SHA-3 algorithm is the safer modern choice. MD5 and SHA-1 are legacy algorithms, although SWGDE, the forensic practitioners' body, notes that they may still be acceptable for specific forensic integrity-verification and file-identification purposes. You will still see them in older cases.

Chain of custody: who touched it, when and why

A hash shows that data has not changed. A chain of custody shows who was responsible for the evidence at every moment. It is a written record of everyone who collected, handled, moved, stored or examined a piece of evidence, with dates, times and reasons, from seizure through the lab to the courtroom. In the physical world, evidence goes into a sealed bag that everyone signs. In the digital world, the record is paired with hashes. A gap in the chain gives the other side in a court case a reason to doubt the evidence, however strong it looks.

Pull the plug or not?

At a scene, one of the first decisions is whether to switch a running computer off. Pulling the plug loses volatile data (Lesson 6.3): memory, running programs, network connections and signed-in sessions. Crucially, a running machine may have an encrypted drive currently unlocked, with the key held in memory. Switch it off and that access may be lost for good.

This matters more today than when the book was written. Encryption is now common by default: Microsoft documents that recent Windows versions can switch on device encryption automatically on eligible hardware.

The IETF's guidelines for evidence collection (RFC 3227, still current) set out the order of volatility: collect the most short-lived evidence first. In practice, that means memory and live system state before the disk, and the disk before backups and archives. There is no single answer to "pull the plug or not". The investigator weighs what would be lost against the risk of leaving the machine running, and records the decision.

Phones and cloud accounts need their own methods. NIST's forensics guide, SP 800-86 (2006), predates smartphones and cloud services. A phone can be erased remotely, and cloud data lives on the provider's systems, not on the device in front of you.

Real-World Example

Imagine (a fictional scenario) a court case two years after a company's laptop was seized. The defence lawyer asks: "How do we know nobody added these files after the seizure?"

The investigator shows three things. First, the evidence form: a bit-stream image was made through a write blocker on the day of seizure. Second, the SHA-256 value recorded that day, which matches the value calculated again in the courtroom. Third, the chain-of-custody log, showing every person who held the drive and the image, with signatures, dates and reasons. Because each link holds, the evidence is accepted. Had the investigator simply copied the folders on the suspect's own laptop, the defence could fairly argue that the evidence had been altered.

From the Book to 2026

What the book teaches. Make a bit-stream image rather than a logical copy, protect the original with a write blocker, prove integrity with a hash (MD5 or SHA-1), keep a chain of custody, and think before pulling the plug.

Why it made sense. These were — and remain — the foundations of sound forensic practice. MD5 and SHA-1 were the standard fingerprints of their time.

What has changed. Security guidance has evolved since the original text. Practical SHA-1 collisions have been demonstrated, NIST is retiring SHA-1, and current guidance now recommends SHA-256 or another SHA-2/SHA-3 hash as the default. We also describe what a hash proves more precisely: no change since hashing, not innocence or guilt. Default encryption makes the "pull the plug" decision even more important, and RFC 3227's order of volatility gives investigators a recognised sequence.

What to do now. If you ever hand evidence to someone else, think like an investigator — keep the original untouched, record what you did and when, and let trained professionals do the copying.

What Would You Do?

You work in a small office's IT team. Your manager suspects an employee of copying client data and says: "Just plug their laptop drive into your PC, copy the documents folder to a USB stick, and we'll look at it later."

What would you advise instead? The answer note below resolves it.

Knowledge Check

Key Takeaways

• Never work on the original: make a bit-stream image, which captures deleted, slack and free space, not just visible files.
• A write blocker lets evidence be read but never written.
• A matching hash proves the data has not changed since hashing; SHA-256 is the default today, while MD5 and SHA-1 are legacy.
• A chain of custody records everyone who handled the evidence, so its integrity can be defended.
• Think before pulling the plug: collect the most volatile evidence first (RFC 3227), especially when encryption is involved.

Further Study

• DFIRScience — Forensic Data Acquisition: Hardware Write Blockers (optional, external). A hands-on look at a hardware write blocker, including its indicator lights, why you test it with a spare drive first, and why flash drives need extra care: their internal controllers can cause small changes that show up as a different hash.

Sources

• NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• IETF — RFC 3227: Guidelines for Evidence Collection and Archiving
• NIST — NIST Retires SHA-1 Cryptographic Algorithm (2022)
• SWGDE — Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics
• CWI Amsterdam and Google — SHAttered (2017)
• NIST CSRC — Glossary: hash function
• Microsoft Learn — BitLocker overview
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 21