Digital Evidence, Chain of Custody & Hashing

This unit focuses on how digital evidence is properly identified, documented, and preserved throughout an investigation. It covers the principle of volatility and why the order in which evidence is collected matters, along with best practices for documenting a scene through photography and detailed notes. A major section is dedicated to chain of custody — how evidence is tracked, labeled, and secured so it remains legally admissible. The notes also explain forensic cloning and imaging, comparing different image formats and the process of creating a verified, tamper-proof copy of a device. The difference between working on a live versus a powered-off system is discussed, along with the associated risks. Finally, hashing algorithms are introduced as the tool used to verify that evidence hasn't been altered. A practical, procedure-focused unit.