evidence

Overview

Finding data is only half of forensics. The other half is being able to trust that data and prove it was not altered. In any serious investigation — and in the authorized, isolated labs where you practice — the value of what you find depends entirely on how carefully you preserve it. This lesson covers the pillars of digital evidence handling: chain of custody, evidence integrity through hashing, and the write-blocking concept that keeps original media untouched.

Learning objectives

• Explain what "evidence integrity" means and why it is essential.
• Describe how cryptographic hashing verifies that data has not changed.
• Explain the concept and purpose of write-blocking.
• Define chain of custody and why it matters even in practice settings.

Core concept

Evidence integrity means that the data you analyze and present is provably identical to what was originally collected — nothing added, removed, or changed. Digital data is fragile: simply opening a file can update its "last accessed" time, and mounting a disk normally can cause the operating system to write to it. If your handling changes the evidence, you can no longer say with confidence what was truly there.

Three practices protect integrity:

• Work on a copy, never the original. You acquire a bit-for-bit image of the source media and analyze that copy, leaving the original preserved and unchanged.
• Prove nothing changed, using hashing. A cryptographic hash acts as a fingerprint of the data; matching hashes prove the copy equals the original and that neither changed later.
• Prevent accidental writes, using write-blocking. A write blocker ensures the acquisition process can read the source but cannot write to it.

Chain of custody is the documented history of the evidence: who collected it, when, from where, and everyone who handled it since. It answers the question "can we account for this evidence at every moment?"

How it works

Cryptographic hashing takes any amount of data and produces a fixed-length string — the hash or digest. The key properties are that the same input always yields the same hash, and that even a one-bit change to the input produces a completely different hash. So the workflow is:

1. When you acquire the image, compute its hash and record it.
2. Anyone can later re-compute the hash of the copy and compare. If it matches the recorded value, the data is unchanged.
3. You also hash the original and the copy at acquisition time; identical hashes prove the copy is a faithful duplicate.

This turns integrity from a promise into something mathematically verifiable. (Older hash algorithms such as MD5 and SHA-1 have known weaknesses; modern practice favors SHA-256, and examiners often record more than one hash.)

Write-blocking addresses a subtler danger: the act of connecting media to a computer can modify it, because operating systems routinely write metadata to any disk they mount. A write blocker — a hardware device or a carefully configured software mode — sits between the source media and the acquisition system and physically or logically permits reads while denying writes. This guarantees the source is not altered during acquisition, which is exactly what the matching hashes will later confirm.

Chain of custody is procedural rather than technical. Each transfer or access is logged with who, what, when, and why. A break in the chain — an unaccounted-for gap — casts doubt on whether the evidence could have been tampered with, which in a real case can render it worthless.

Practical example

In an authorized lab, you are handed a practice USB drive and asked to investigate it. Instead of plugging it into your workstation and browsing the files, you follow sound practice:

1. You connect the drive through a write blocker so nothing can be written back to it.
2. You acquire an image — a complete bit-for-bit copy — of the drive.
3. You compute a SHA-256 hash of both the original and the image. Suppose both produce the same digest, for example a value beginning 9f2a.... Identical hashes confirm the image is a perfect copy.
4. You store the original safely and do all analysis on the image. When you finish, you re-hash the image; because it still begins 9f2a..., you can prove your analysis did not change it.

If, instead, someone had opened files directly on the original drive, the "last accessed" timestamps might have changed, the hash would no longer match, and you could no longer prove what the drive originally contained.

[!WARNING] These practices apply only to media you are authorized to examine — CTF challenge files, lab images, or systems you have written permission to investigate. Never image or analyze devices you do not own or lack permission to handle.

Cybersecurity relevance

Evidence integrity is the backbone of incident response and any investigation whose findings might be reviewed, disputed, or (in a real case) used in legal proceedings. Even inside a company, an internal investigation loses credibility if the data could have been altered. Hashing, working on copies, write-blocking, and chain of custody are what let an examiner say, under scrutiny, "this is exactly what was there, and here is the proof."

In CTF forensics, you rarely have to maintain a formal chain of custody, but the same discipline pays off: work on a copy of the challenge file, keep the original pristine so you can start over, and use hashes to confirm you are analyzing the file you think you are. The habit you build in labs is the habit that makes you trustworthy in real investigations.

Common mistakes

• Analyzing the original media directly, altering timestamps or metadata and destroying integrity.
• Skipping the hash, leaving no way to prove the data is unchanged.
• Assuming a copy is faithful without verifying matching hashes at acquisition.
• Neglecting chain of custody, creating unexplained gaps that undermine trust in the evidence.
• Relying on a weak hash algorithm alone when stronger options are available.

Key takeaways

• Evidence integrity means proving the analyzed data is identical to what was collected; digital data is fragile and easily altered.
• Cryptographic hashing provides a verifiable fingerprint — matching hashes prove data is unchanged; prefer modern algorithms like SHA-256.
• Write-blocking prevents accidental writes to source media during acquisition, so the original stays pristine.
• Chain of custody documents who handled evidence, when, and why; gaps undermine its credibility. Always work on a copy, never the original.

Check your understanding

• How does computing and comparing hashes let you prove that a disk image was not altered during analysis?
• Why is a write blocker necessary when acquiring an image, given that operating systems can write to any disk they mount?