Question

Conduct research using the Internet for information about chain of custody in computer forensic cases. Describe why chain of custody is so important and the process for ensuring it's accurate.

Answer 1

ANSWER:

A chain of custody in digital forensics is referred to as the forensic link, the paper trail, and the chronological documentation of electronic evidence. The chain of custody controls the collection, sequence of control, transfer, and analysis of the documents and evidences and artifacts in the computer forensic cases. I takes into consideration if the chain of custody was correct and also the documents each person who handled the evidence, and the date/time it was collected or transferred and also the purpose of the transfer. A chain of custody is important as it accounts for seizure, storage, transfer and condition of the evidence and that the Evidence should be Reliable when presented.

The chain of custody is important to preserve the integrity of the evidence and also prevent it from contamination such that no unauthorized parties are handed over the evidence and every party is thereby recorded in the flow of evidence handling. As crime and computer forensic evidence can be very important and in many cases help to find out more about the case on analysis, thus the chain of custody is the process to preserve it and thus without which the evidence presented in court can also be challenged and ruled inadmissible.

The chain of custody is greatly important to the examiner to process and analyze for information for ensuring it's accurate and thus if contaminated we cannot extract information from it, thus with the evidence the chain of custody also has to be checked to make is sure that integrity of the evidence has not been played with. Thus the chain of custody is so important for the examiner, the law enforcement and also tot he court. The chain of custody should follow the below procedures to start with:

a) Saving the original materials and copying them and making necessary copies so that the original is safe.

b) Photos of the physical evidence should be taken.

c) Screenshots of digital evidence should be taken.

d) Document and object date time and other information should be there with the evidence.

e) Clone the digital evidence into many copies for testing.

f) Should perform a hash test to authenticate the working clone and such that it can be tested.

g) We should use clean collecting media to copy and retrieve the digital evidences.

h) We should document anything and everything that is in the scope of the evidence and the crime and related to it.