Digital › Module 1 › Lesson 2
Chain of Custody
Chain of custody names who handled evidence, when, and why — document every transfer on YOUR $DFIR_LAB case notes before any tool run.
Visual · t26_chain_of_custody
CoC literacy. $DFIR_LAB only. Original Cyberlium.
Opening
If you cannot prove who touched the artifact, the finding may not survive review — CoC is paperwork discipline first.
Chain of custody (CoC) is the chronological record of evidence possession: collector, date/time (UTC), location, media identifier, hash at receipt, each transfer, and purpose of access. Gaps invite challenge in legal, HR, or regulatory review — even in lab practice you train the habit. Cyberlium documents CoC fields on YOUR $DFIR_LAB practice cases — course images, self-created VMs, authorized lab scenarios — never ad-hoc copies of stranger devices without authority. Next: Legal Authority.
1. CoC fields defenders expect (named)
Minimum literacy: case ID, exhibit ID, description, serial/media ID, collector name, collection datetime UTC, storage location, hash (MD5/SHA-256) at intake, each handler, transfer datetime, reason for access, and return/seal status.
On $DFIR_LAB, draft a CoC row for one practice image — fictional case numbers are fine. Real cases use org forms; the habit is identical.
Command guide
Try these commands — CoC fields defenders expect (named)
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, curl. Reference sites: Sleuth Kit (https://www.sleuthkit.org/); Autopsy (https://www.autopsy.com/); CISA DFIR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why CoC matters before tools
Autopsy, FTK, and Volatility read evidence — they do not replace custody logs. Working copies get their own exhibit IDs and hashes; originals stay sealed when policy requires.
If you cannot answer 'who had this E01 on Tuesday at 14:00 UTC?', pause and fix notes before analysis spreads.
3. Integrity habits CoC supports
Forbidden: editing original images in place, reusing one hash line for unrelated copies, or 'just opening it quickly' without logging access. Allowed: working copy workflow with documented parent hash and analyst initials.
Ship: CoC template — eight fields filled for one $DFIR_LAB practice exhibit. Next: Legal Authority.
4. What you ship: CoC template row for $DFIR_LAB
CoC row: case ID, exhibit, collector, UTC time, hash, handler log stub. $DFIR_LAB named. NEVER skip custody. chmod 600.
5. What you record before the next lesson
Date. CoC template. $DFIR_LAB named. File t26-m01-l02-chain-of-custody.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Analyze a practice image with no handler log. Share custody forms with victim PII in public chat.
Right
Write CoC template row for YOUR $DFIR_LAB practice exhibit. Next: Legal Authority.
Mission: draft YOUR CoC row
1) Pick one practice image in $DFIR_LAB. 2) Fill eight CoC fields. 3) Note working-copy vs original rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
UTC timestamps in CoC prevent timezone arguments later.
Knowledge Check
APPLY: Chain of custody on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: CoC should include hash values at intake.
True or False
Knowledge Check
APPLY: Before opening Autopsy on a practice image you should:
Multiple choice