Digital › Module 1 › Lesson 2
Chain of Custody
Chain of custody names who handled evidence, when, and why — document every transfer on YOUR $DFIR_LAB case notes before any tool run.
Visual · t26_chain_of_custody
CoC literacy. $DFIR_LAB only. Original Cyberlium.
Opening
If you cannot prove who touched the artifact, the finding may not survive review — CoC is paperwork discipline first.
Chain of custody (CoC) is the chronological record of evidence possession: collector, date/time (UTC), location, media identifier, hash at receipt, each transfer, and purpose of access. Gaps invite challenge in legal, HR, or regulatory review — even in lab practice you train the habit. Cyberlium documents CoC fields on YOUR $DFIR_LAB practice cases — course images, self-created VMs, authorized lab scenarios — never ad-hoc copies of stranger devices without authority. Next: Legal Authority.
1. CoC fields defenders expect (named)
Minimum literacy: case ID, exhibit ID, description, serial/media ID, collector name, collection datetime UTC, storage location, hash (MD5/SHA-256) at intake, each handler, transfer datetime, reason for access, and return/seal status.
On $DFIR_LAB, draft a CoC row for one practice image — fictional case numbers are fine. Real cases use org forms; the habit is identical.
Command guide
Try these commands — CoC fields defenders expect (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sleuth Kit — https://www.sleuthkit.org/ (filesystem forensics toolkit literacy) Autopsy — https://www.autopsy.com/ (GUI over Sleuth Kit — docs literacy) CISA DFIR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t26-dfir/evidence" "$HOME/cyberlium-lab/t26-dfir/notes" "$HOME/cyberlium-lab/t26-dfir/pcap" "$HOME/cyberlium-lab/t26-dfir/report" cat > "$HOME/cyberlium-lab/t26-dfir/lab.env" <<'EOF' export LAB_DFIR=$HOME/cyberlium-lab/t26-dfir export LAB_DFIR_EVIDENCE=$HOME/cyberlium-lab/t26-dfir/evidence EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t26-dfir/lab.env" grep -E 'LAB_DFIR' "$HOME/cyberlium-lab/t26-dfir/lab.env" curl -sS https://www.sleuthkit.org/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Sleuth Kit (https://www.sleuthkit.org/); Autopsy (https://www.autopsy.com/); CISA DFIR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why CoC matters before tools
Autopsy, FTK, and Volatility read evidence — they do not replace custody logs. Working copies get their own exhibit IDs and hashes; originals stay sealed when policy requires.
If you cannot answer 'who had this E01 on Tuesday at 14:00 UTC?', pause and fix notes before analysis spreads.
3. Integrity habits CoC supports
Forbidden: editing original images in place, reusing one hash line for unrelated copies, or 'just opening it quickly' without logging access. Allowed: working copy workflow with documented parent hash and analyst initials.
Ship: CoC template — eight fields filled for one $DFIR_LAB practice exhibit. Next: Legal Authority.
4. What you ship: CoC template row for $DFIR_LAB
CoC row: case ID, exhibit, collector, UTC time, hash, handler log stub. $DFIR_LAB named. NEVER skip custody. chmod 600.
5. What you record before the next lesson
Date. CoC template. $DFIR_LAB named. File t26-m01-l02-chain-of-custody.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Analyze a practice image with no handler log. Share custody forms with victim PII in public chat.
Right
Write CoC template row for YOUR $DFIR_LAB practice exhibit. Next: Legal Authority.
Mission: draft YOUR CoC row
1) Pick one practice image in $DFIR_LAB. 2) Fill eight CoC fields. 3) Note working-copy vs original rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
UTC timestamps in CoC prevent timezone arguments later.
Knowledge Check
APPLY: Chain of custody on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: CoC should include hash values at intake.
True or False
Knowledge Check
APPLY: Before opening Autopsy on a practice image you should:
Multiple choice