Chain of custody (digital evidence)

The chain of custody is the documented sequence of steps that seize, copy, hash and store the digital evidence of an incident, so that it holds up in court and with the insurer. On May 26, 2020, a federal magistrate judge in the Eastern District of Virginia ordered Capital One to hand plaintiffs the forensic report Mandiant had written after the 2019 breach, and the district judge affirmed on June 25. The report had been commissioned under an existing engagement and circulated well beyond counsel: it became an exhibit, and every finding in it could be challenged on its source. Digital evidence is only worth its chain of custody: who seized which device, when, with what tool, where it was stored, who opened it next. ISO/IEC 27037, published in October 2012 and confirmed in 2018, sets out the steps: identification, collection, acquisition, preservation. In the field, that means a bit-for-bit disk image taken behind a write blocker, a memory capture before shutdown, and a SHA-256 (Secure Hash Algorithm) hash computed at acquisition and recomputed on every copy. Add to that firewall, directory and EDR (endpoint detection and response) logs exported to write-once storage, and a signed transfer log. The criminal complaint depends on it (in France, Article L. 12-10-1 of the Insurance Code requires one within 72 hours for the insured to be paid), as do the recovery action against a negligent managed service provider and the proof of loss: the carrier must be able to date the intrusion against the retroactive date and check that no exclusion applies. The classic conflict comes on day one, when IT rebuilds the servers to get running again and the logs go with them. Dwell time can no longer be measured, nor the scope of exfiltration, and notification is done on the worst case. Preservation is paid as forensic cost; what gets negotiated is the wording of the duty to preserve, which the insured wants as best efforts and the carrier as an obligation of result.