From Crime Scene to Courtroom: Acquire, Preserve, Analyze, Report

What you'll be able to do

By the end of this lesson you will be able to walk a piece of digital evidence from the crime scene to the courtroom.

• Describe the four stages of a forensic investigation: acquire, preserve, analyze and report.
• Explain what a chain of custody is and what it must record.
• Explain why staying within the scope of a warrant or other authority is essential.

Stage 1: Acquiring the Evidence

Acquisition is done with forensic software that takes a bit-by-bit copy of the suspect's storage media. "Bit-by-bit" means everything is copied, not just the files you can see, so deleted material and unused space come along too.

The book sets out the rules:

• The evidence must not be written to. Hardware and software write-protection (Lesson 4.2 covers write-blockers) stop the examiner's computer from changing the evidence drive.
• Work on the copy, never the original. Once an exact copy exists, all work is done on it and the original is not touched again unless absolutely necessary.
• Make two copies. Many investigators make two exact copies, so that if one fails they still never have to go back to the original.
• Prove the copy is exact. A hash, a value calculated by a mathematical algorithm, is computed for the original and for the copy. If they match, the copy is identical. Lesson 2.1 explains hashing in depth.

Stage 2: Preserving the Evidence

Avoiding changes during copying is not enough. From the scene until its presentation in court, the evidence must be transported, stored and accounted for at all times. The book names two kinds of protection:

• Physical protection. Anti-static bags, proper packaging and careful transport, so the media is not damaged.
• A paper trail: the chain of custody. A record of everyone who has come into contact with the evidence.

A good chain-of-custody record answers five questions for every movement: who had the item, when (date and time), where it was, why it was transferred or accessed, and what was done with it. Each person signs. A gap in the chain gives the other side a reason to argue that the evidence could have been altered, however strong it otherwise looks.

Stage 3: Analyzing the Evidence

This is where the real search begins. The examiner looks through the files and locations on the copy: documents, pictures and items deleted in an attempt to get rid of evidence. A computer is full of data, but only some of it is meaningful to the case. Forensic software makes large drives searchable and helps the examiner find, filter and interpret what matters. Part III covers the techniques.

Stage 4: Reporting

The book makes a striking point: up to this stage, nothing has been produced that can be introduced in court. The report is what turns work into evidence. It must explain, clearly and readably, everything that was done, how it was done and what was found. Based on the report, someone else should be able to repeat the work and produce exactly the same results. Part VI shows how to write one.

The Scope of the Warrant

Dr. Al-Doori is firm: investigators do not have free rein. They are limited by the scope of the warrant. If you do not have a warrant or other lawful authority, do not search. Even with one, you are limited to what it covers.

His example: you are investigating a fraud and come across evidence that the suspect may also be selling illegal drugs. You must stop and obtain another warrant before going down that path. Going outside your scope could get the evidence thrown out of court, and every defense lawyer is looking for exactly that kind of technicality.

Outside criminal cases, the same principle applies to other kinds of authority. A company investigation must stay within the organization's documented authorization, its policies and the law.

Real-World Example

Here is a fictional chain-of-custody record for one item, a USB stick seized at an office:

Item: EV-024 · USB flash drive, 64 GB, black, serial noted on label
Case: 2026-0412 (fictional)

Date/time (UTC)   From → To               Purpose                    Signature
2026-05-04 10:12  Seized by J. Okoro      Found in desk drawer B2;    J.O.
                                          photographed in place
2026-05-04 10:20  J. Okoro → evidence bag Sealed, bag no. 55120       J.O.
2026-05-04 14:05  J. Okoro → Lab intake   Logged by M. Haddad         J.O. / M.H.
2026-05-04 14:20  M. Haddad → Lab store   Stored, seal 55120 intact   M.H.
2026-05-05 09:30  Lab store → A. Silva    Seal 55120 checked intact;  A.S.
                                          imaging via write-blocker;
                                          SHA-256 recorded on form
2026-05-05 11:02  A. Silva → Lab store    Returned, bag resealed      A.S.
                                          no. 55121

Every movement has a time, a person, a reason and a signature, and the seal numbers show when the bag was opened and resealed. If the defense asks in two years' time who touched this USB stick and why, the record answers.

From the Book to 2026

What the book teaches. Acquire a bit-by-bit copy with write protection and prove it with a hash; preserve the evidence physically and with a chain of custody; analyze only the copy; report so that others can repeat the work; and stay within the scope of the warrant.

Why it made sense. These are the foundations of trustworthy digital evidence, and they have not changed.

What has changed. Mostly the surrounding practice has matured. Courts and standards now explicitly recognize hash-verified copies. In the United States, Federal Rule of Evidence 902(14), added in 2017, allows data copied from an electronic device to be authenticated through a certification of a "process of digital identification" (in practice, usually matching hash values) instead of live testimony. In the UK, the long-standing police good-practice guide for digital evidence sets out four principles that mirror the book: no action should change data that may be relied on in court; anyone who must access original data must be competent and able to explain their actions; an audit trail of all processes must be kept; and the person in charge is responsible for making sure the principles are followed. In England and Wales, digital forensic work for the criminal courts has also been covered since October 2023 by the Forensic Science Regulator's statutory Code of Practice. The hash algorithm itself has also moved on: SHA-256 is now the default (Lesson 2.1).

What to do now. Treat the four stages and the chain of custody as non-negotiable. Record hashes with every acquisition, record every movement, and check your authority and its scope before you look at anything.

Watch: Digital Forensics (Security+ 4.8)

In this short lesson, Professor Messer, a widely used IT certification instructor, covers the professional practices around forensic evidence. According to the published lesson notes, it covers the IETF's evidence-collection guidelines (RFC 3227), legal holds, keeping data unmodified, the chain of custody with hashes, the many places data can be acquired from, reporting, working from copies, and e-discovery.

As you watch, notice:

• How a legal hold fits before Stage 1: a legal instruction to keep specific data before anyone collects it.
• The list of overlooked data sources, such as log files, recycle bins, temporary storage, browser bookmarks and saved logins.
• Why working from copies matters especially for mobile devices that can be erased remotely, and why live collection may be needed when encryption locks data at power-off. Lesson 3.4 returns to this.

The video complements what you just read. The lesson is complete without it.

What Would You Do?

You are examining a company laptop under written authorization to look for evidence that an employee leaked a price list. While searching, you see a folder of personal photos and a file named "medical_results.pdf". What do you do with them? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• The four stages are acquire, preserve, analyze and report; each is essential.
• Acquire a bit-by-bit copy with write protection, prove it with a hash, and work only on the copy.
• The chain of custody records who, when, where, why and what for every movement of the evidence.
• Nothing is evidence until it is reported in a way others can repeat.
• Stay within the scope of your warrant or authority; outside it, stop and seek more.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.1
• Cornell Law School LII — Federal Rules of Evidence, Rule 902 (including 902(14))
• Digital Detective — ACPO Good Practice Guide for Digital Evidence (principles)
• GOV.UK — Forensic Science Regulator: Code of Practice
• IETF — RFC 3227: Guidelines for Evidence Collection and Archiving
• NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• Professor Messer — Digital Forensics, CompTIA Security+ SY0-701 4.8 (lesson notes)