## Evidence Handling & Chain of Custody

If you cannot prove who held the evidence, the evidence is worthless.

### Chain of Custody (CoC)
A legal document that tracks the life of a piece of evidence.
*   **Fields**:
    *   Item Description: "Seagate 1TB HDD, Serial #XYZ".
    *   Date/Time: "2023-10-27 14:00".
    *   Released By: "John Doe (Analyst)".
    *   Received By: "Jane Smith (Evidence Locker Manager)".
    *   Reason: "Overnight Storage".
*   **Gap in Chain**: If the drive was logged out on Friday and logged back in on Monday, but nobody signed for it over the weekend, the Defense will say: "Someone replaced the drive." Case dismissed.

### Evidence Integrity (Hashing)
How do we prove the file hasn't changed in 5 years? **Hashing**.
*   **MD5 / SHA1**: Old, broke. (Collisions possible).
*   **SHA256**: The standard.
*   **Procedure**:
    1.  Acquire the drive image.
    2.  Calculate SHA256 immediatey. (e.g., `A1B2...`).
    3.  Record `A1B2...` in the CoC.
    4.  Six months later in court, hash the drive again.
    5.  It MUST match `A1B2...` exactly. If one bit changed, the hash changes completely.

### The Evidence Locker
*   Physical security.
*   Restricted access (Badge in/out).
*   Faraday Bags: Bags lined with metal mesh to block radio signals. Use these for Mobile Phones (so they don't receive a "Remote Wipe" command from the iCloud/Google).