Chain of Custody & Forensic Readiness
What is it?
Chain of custody is the documented record of who held each piece of evidence, when, and what they did with it — an unbroken sequence from collection to presentation. Forensic readiness is the organizational preparation that makes future investigations possible: logging enabled, retention set, handling procedures known BEFORE an incident.
Why it matters
A gap in custody is a gap in the case: 'where was the drive on Tuesday?' with no answer invites the argument that anything could have happened to it.
Where you see it
The custody form that travels with every evidence item; the readiness audit that asks 'if this server were compromised today, what logs would exist?'
What normal looks like
Every transfer signed and timestamped; investigations that find the logs they need because retention was decided years earlier.
What suspicious looks like
The investigation that discovers, too late, that the logs it needs were overwritten after seven days — a readiness failure that no analyst skill can repair.
How analysts investigate
By documenting every handoff at collection time, and by treating retention and logging policy as forensic infrastructure, not IT housekeeping.
Common beginner mistakes
- Starting custody documentation 'once the case looks serious' — custody cannot be reconstructed backwards; it exists from collection or not at all.
Wadi's investigation needs proxy logs from six weeks ago. Retention: 14 days. The evidence no longer exists — not because anyone destroyed it, but because nobody decided to keep it. Forensic readiness is the unglamorous work that determines, years in advance, which investigations will be possible.
Quick check
The drive was collected Monday and analyzed Thursday, and no record says where it was in between. Why is this a problem even if nothing actually happened to it?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.