# Chain of Custody & Evidence Handling

If you have a smoking gun with the suspect's fingerprints on it, but you leave it sitting in a public hallway for 3 hours before giving it to the police, the evidence is useless in court. The defense attorney will simply say: *"Someone else must have touched it while it was in the hallway."*

The exact same concept applies to digital evidence.

## What is the Chain of Custody?
The **Chain of Custody** is a chronological, written record detailing the seizure, custody, control, transfer, analysis, and disposition of physical or digital evidence. 

It answers four critical questions at any given point in time:
1.  **Who** collected the evidence?
2.  **How** and **where** was it collected?
3.  **Who** had possession of it subsequently?
4.  **How** was it stored and protected in the meantime?

If the chain is broken (unaccounted time or an undocumented transfer), the evidence may be deemed inadmissible in legal proceedings.

## Hashing for Integrity
How do you prove that the 500GB hard drive image you took last year is exactly the same today, and that you haven't maliciously altered any files on it to frame someone?

**Hashing.**

A cryptographic hash (like MD5, SHA-1, or SHA-256) is a one-way mathematical algorithm that assigns a unique, fixed-size string of characters to a piece of data. It acts as a digital fingerprint.

### The Hashing Workflow:
1.  **Acquisition:** You arrive on scene and create a forensic image (`image.dd`) of the suspect's laptop.
2.  **Initial Hash:** Immediately, you run a SHA-256 hash on `image.dd`. The result is: `5e884...a13`.
3.  **Documentation:** You write that hash value down on your official Chain of Custody form.
4.  **Verification:** A year later in court, the defense demands proof that the image wasn't tampered with. You run the SHA-256 hash again on your copy. It outputs `5e884...a13`. The fingerprints match. 

If even a *single byte* in that 500GB image was changed, the resulting hash would be completely different.

## Write Blockers
When acquiring evidence from a physical hard drive, you must avoid altering it. Simply booting up a Windows hard drive makes hundreds of registry changes and alters file access times instantly.

To prevent this, forensics analysts use hardware or software **Write Blockers**. 
A hardware write blocker sits between the suspect's hard drive and your forensic workstation. It allows your computer to *read* the data from the drive to make a copy, but physically intercepts and blocks any *write* commands, preserving the original evidence perfectly pristine.