Digital Forensics: Evidence Collection, Chain of Custody, and Legal Admissibility

Digital Forensics Fundamentals

Digital forensics is the process of collecting, preserving, analyzing, and presenting digital evidence in a manner that is legally admissible. Whether supporting an internal investigation or law enforcement action, proper forensic methodology is essential.

Evidence Collection

Order of Volatility

Collect evidence from most volatile to least volatile:

1. CPU registers and cache (nanoseconds)
2. RAM / Running processes (power-dependent)
3. Network connections (transient)
4. Temporary files / Swap space (session-dependent)
5. Hard drive data (persistent)
6. Remote logging (persistent, external)
7. Physical configuration (persistent)
8. Archival media (persistent, offline)

Memory Capture

# Linux memory acquisition
sudo dd if=/dev/mem of=/evidence/memory.raw bs=1M
# Or using specialized tools
sudo ./avml /evidence/memory.lime

Disk Imaging

Create a forensic bit-for-bit copy:

# Create forensic image with hash verification
dc3dd if=/dev/sda of=/evidence/disk.raw hash=sha256 log=imaging.log

Network Evidence

• Capture active connections: netstat -antp
• Packet capture: tcpdump -w /evidence/capture.pcap
• DNS cache: ipconfig /displaydns (Windows)

Chain of Custody

Every piece of evidence must be tracked:

• Who collected it
• What was collected
• When it was collected
• Where it was stored
• How it was protected
• Why it was collected

Documentation template:

Evidence ID: E-2026-001
Description: Forensic image of server web01 (/dev/sda)
SHA256: abc123...
Collected by: [Analyst Name]
Date/Time: 2026-02-15T14:30:00Z
Storage: Evidence locker, Room 301

Analysis Techniques

Timeline Analysis

Reconstruct events chronologically:

• File system timestamps (MACB: Modified, Accessed, Changed, Born)
• Log entries across multiple sources
• Registry modifications (Windows)
• Browser history and artifacts

Artifact Analysis

Extract forensic artifacts:

• Browser history, cookies, cache
• Email headers and attachments
• Recent documents and USB history
• Deleted files and slack space

Malware Analysis

• Static analysis: File hashes, strings, imports
• Dynamic analysis: Sandboxed execution
• Memory analysis: Process injection, hooks

Where SuperClue Fits

SuperClue does not collect forensic images or manage chain of custody. During an investigation it gives you the incident timeline and 7 days of raw agent telemetry to search.