Forensic/data recovery good practice

Contents [hide]

• Background information
• Related Topics
• Further reading

Background information

While there a loads of courses and sources that can teach you the technical information(highly recommend reading or watching them)

They often do not cover the skills to problem-solve and build up the confidence to take an unknown project with no or limited experience. That is the ultimate goal of the course is to provide people with the confidence to try skills, and not be affarid of failure because it's a natural part of learning.

That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.

Maintaining the validity of data within handled devices

contemporaneous notes

If you are making physical notes, it is critically important that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, Do not attempt to scribe it out as it may look like your hiding something.
By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.

Chain of custody(COC)

Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who an exhibit (piece of evidence) has been all the way from seizure from the crime scene till the exhibit is destroyed.
COC is used to ensure that an exhibit is not tampered with at all alongside other methods such as storing the exhibit with a ISO 27025 compliant storage room. If an exhibit is tampered with or a claim is made stating that, then/br> it is possible to trace back until the responsible party is located, or a mistake is identified.
A COC form should consist of at least the following.

• Name and signature of person/s who are gaining access to the exhibit
• Location - where the exhibit was kept
• Access log - which people could physically access the exhibit
• Activities - What happened either with or to the exhibit
• Date and time of access - What time and date was the exhibit access (01/Oct/25)
• Reason for access - Why do did you need to physically access the exhibit(e.g. imaging the device)
• Case Reference number - The reference number of the case the exhibit is a part of
• bag seal number - The unique number of the evidence bag the exhibit is stored in

ACPO principles

• Principle 1: No action taken by law enforcement agencies, persons employed within those agencies or their agents should change data which may subsequently be relied upon in court.
Explanation: Nobody who works either for or on behalf of law enforcement agencies (police, government or people contracted to preform a role by the agencies)
should change any data either from or still on a device, which maybe used as part of a case in a court.
• Principle 2: In circumstances where a person finds it necessary to access original data, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
Explanation: While principle 2 says you should never ever change data that will be used in court. It is okay (access logs from access images on a device for example, not planting evidence.) if there is no other way to access data, on a device BUT the person doing it needs to know what there doing and be able to explain what they did, what affects
their actions had on the device (what data changed) and why it was absolutely necessary it was done this way(e.g. there was no other viable option to retrieve the data>.
• Principle 3: An audit trail or other record of all processes applied to digital evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
Explanation: Make notes of everything, how it was done, what was done, what was it done on (software, version numbers and hardware). When it was done
The goal is for another person to be able to recreate the exact results using only your notes (not including how to instructions) it is assumed and hoped the person is competent. The standard date formatting for the UK is as follows, 11/OCT/2025) this clearly shows it was done on the 11th of October (11/10/25) and not the 10th of November (10/11/25)
this practice helps avoid mistakes as different parts of the world use different data formats.
• Principle 4: The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to.
Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.

Related Topics

Topics such as desoldering to chip off or firmware dumping for disk PCB repairs

• Related Topic 1
• Related Topic 2

Further reading

External references in wiki references can just be cited through the keyword link

1. Reference 1: Forensics for dummies page 49-50(chain of custody)
2. Reference 2: ACPO principles (section 2.1)