Information Technology Reference
In-Depth Information
Figure 7.3 The.type.of.media.on.which.you.store.or.deliver.the.evi-
dence.will.depend.on.many.factors.
media. such. as. DVDs,. CDs,. tape,. or. USB. devices. such. as.
hard.drives.or.lash.drives..As.long.as.this.copying.is.done.in.
a.forensically.sound.manner.that.ensures.the.integrity.of.the.
data,.that.should.be.suficient.for.most.situations.(Figure 7.3).
The.ways.you.can.ensure.a.forensically.sound.copying.of.
data.to.these.media.are.as.follows:
•. Create.and.document.at.least.two.different.hashes.of.
the.data.before.and.after.copying.(see.Chapter.5.for.
more.details).
•. Maintain.a.chain.of.custody,.documenting.where.the.
data.were.originally,.who.was.the.custodian,.who.cop-
ied.the.data,.when,.and.for.what.purpose.
•. Document. the. tools. used. to. copy. the. data. including.
their.version.numbers.
Appendix.B.includes. some.sample. logging.and.chain.of.
custody.documents.
In.other.cases.the.parties.involved.might.decide.on.trans-
ferring. the. data. using. e-mail. or. an. online. service.. In. these.
cases,. you. can. ensure. the. integrity. of. the. data. by. using.
hashes.and.maintaining.good.logging.of.all.activities.involved.
in. copying. the. data.. This. should. be. agreed. upon. up. front.
between.all.of.the.parties.
