FieldP-06 · Volatile first, chain intact
Handle Digital Evidence
Acquire computer evidence in an order and a manner that survives scrutiny.
Step 1
Confirm Authority
Only examine devices and accounts you own or are authorized in writing to examine.
Step 2
Work Down the Volatility Order
Registers and cache; routing table, ARP cache, process table, kernel statistics, memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; archival media.
Step 3
Document the State Before Touching
Photograph the screen, record what is running, note the system clock against a trusted reference.
Step 4
Acquire, Then Hash
Image the media, then hash source and copy and record both. Matching hashes support authenticity under Federal Rule of Evidence 902(14). They do not by themselves make a copy admissible.
Step 5
Write the Chain of Custody
Item, description, who acquired it, when, how, hash at acquisition, where it is stored, and every transfer with a timestamp and a reason.
Step 6
Analyze the Copy Only
The original is sealed. Every analytic step is logged so another examiner can repeat it.
Step 7
Report Method, Not Just Result
Name the tools and versions and explain why they were chosen. A result nobody can reproduce is an assertion.
How It Fails
Pulling the disk first and losing memory; an evidence bag with a gap in the log; a finding that cannot be reproduced.