Digital forensics covers three linked jobs: imaging a device so the original is never touched, capturing the metadata that gives the resulting data meaning, and preserving both in a way that will survive challenge in court. Each step has its own technical standards and its own legal consequences if done poorly. A perfectly executed image is worthless without a documented chain of custody, and a meticulous custody log can’t rescue evidence collected from a drive that was written to during acquisition. The workflow below is what a defensible examination looks like from seizure through authentication.
Collect in the Right Order Before Imaging
Imaging is not always the first step. Electronic evidence sits on a spectrum from extremely volatile to highly stable, and collecting in the wrong order destroys the most valuable material. Internet Engineering Task Force guidance lays out a priority sequence: CPU registers and cache first, then system memory (RAM), temporary file systems, hard drives, remote logs, and finally archival media like backup tapes.1Internet Engineering Task Force. Guidelines for Evidence Collection and Archiving – RFC 3227
The practical stakes are simple. Pull the power cord on a running machine and everything in RAM disappears: encryption keys, active chat sessions, running processes, unsaved file fragments. A skilled examiner captures a memory dump from the live system before shutting anything down. Network connections and routing state evaporate the moment the machine goes offline, so those get grabbed too. Only after the volatile evidence is secured does the team move to full forensic imaging of the storage media.
Forensic Imaging of Storage Media
The foundation of any examination is a bit-stream image, a bit-for-bit clone of the original device. A standard file copy captures only what the operating system recognizes as active files. A forensic image captures the entire physical medium, including unallocated space where deleted files may still linger and slack space, the leftover bytes at the end of storage blocks where fragments of older files can persist.
Write Blockers
Preventing any change to the original is non-negotiable. Hardware write blockers sit between the source drive and the examiner’s workstation, splitting the connection so read commands pass through but write commands are physically prevented from reaching the source. The National Institute of Standards and Technology publishes formal specifications for these devices: a compliant write blocker must never transmit a modifying command to the protected storage, must return all requested data from read operations, and must accurately report any error conditions the drive produces.2National Institute of Standards and Technology. Hardware Write Blocker Device Specification – Version 2.0 NIST also publishes the testing strategy used to validate them.3National Institute of Standards and Technology. A Strategy for Testing Hardware Write Block Devices
This matters in court because opposing counsel can challenge evidence by arguing the original drive was altered during collection. A write blocker validated against NIST specifications, documented in the case notes, eliminates that line of attack.
Image Formats
Forensic software reads the source drive through the write blocker and writes the clone into a container file. Two formats dominate. E01, the EnCase evidence file, has become a de facto standard because it supports compression and stores metadata like case numbers and examiner notes alongside the image data. Raw images (often called DD after the Unix utility that originally produced them) are simpler but carry no metadata at all. The choice is a tradeoff between storage efficiency and compatibility with the analysis tools the team plans to use.
Tools like EnCase Forensic and FTK Imager are the workhorses. NIST’s Computer Forensic Tool Testing program independently tests forensic software to confirm it produces accurate results, and those test reports give investigators documentation they can point to when defending their methodology.4National Institute of Standards and Technology. Computer Forensics Tool Testing Program
Metadata Captured Alongside File Content
Metadata is information about a file rather than its content, and it often tells a more revealing story than the document itself. Examiners work with three broad categories, each stored in a different place and each answering different questions.
System Metadata
The operating system generates timestamps every time a file is created, modified, accessed, or moved. On Windows systems using NTFS, these live in the Master File Table and support a broad timeline of device activity. When did someone last open this folder? Was this file copied to the desktop before or after the resignation letter was drafted? System metadata answers those questions.
File Metadata
Individual documents carry their own embedded properties. A Word file records the original author’s name, the number of revisions, total editing time, and the software version used to create it. These fields live inside the file, not in the operating system, so they travel with the document even when it’s copied to a USB drive or emailed to a third party. In intellectual property disputes, file metadata can prove who actually created a document and how many hands it passed through.
Application Metadata
Specific applications embed their own artifacts. Digital cameras and smartphones store EXIF data inside photo files, including GPS coordinates that pinpoint where an image was taken and timestamps for when the shutter fired.5SCIEPublish. Forensic Value of Exif Data: An Analytical Evaluation of Metadata Integrity across Image Transfer Methods Email headers record sender IP addresses and the servers that relayed each message. Web browsers maintain history databases, cached pages, and cookie files that reconstruct online activity. Each of these adds specificity to the investigative timeline.
Because a forensic image is a bit-for-bit clone of the original medium, all three metadata categories come along with the acquisition. A file copy strips most of it. That difference is one of the main reasons the imaging step exists at all.
Proving the Image Matches: Hash Verification
An image is only useful if you can prove it is identical to the original. Immediately after imaging, the examiner generates a hash value for both the source device and the forensic copy. A hash algorithm processes the entire contents of the drive and produces a fixed-length string. If a single bit changes anywhere in a terabyte of data, the hash output changes completely.6Scientific Working Group on Digital Evidence. SWGDE Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics Matching hashes between original and copy prove the image is a perfect replica.
MD5 and SHA-1 were the standard for years, but both have been shown vulnerable to collision attacks, meaning researchers have demonstrated that two different inputs can produce the same hash. The forensic community has moved toward SHA-256 and other members of the SHA-2 family, which provide stronger collision resistance. In practice, many examiners now run both a legacy algorithm and SHA-256 so their output remains compatible with older case files while meeting current expectations.
Hashing is also what gets rerun later. Before any analysis session, the examiner hashes the working copy again and compares it against the value recorded at acquisition. If the values still match, the analysis is being performed on unaltered data. If they don’t, something is wrong and the examination stops until the discrepancy is explained.
Chain of Custody
A chain of custody log tracks every person who handled the evidence, every transfer between locations, and every period of storage from seizure through trial. The log records the name of each handler, the date and time of each handoff, and the storage location, whether that’s a physical evidence locker or an encrypted server.7National Institute of Justice. Law 101: Legal Guide for the Forensic Expert – Chain of Custody
Courts take gaps in this documentation seriously. If the chain is broken, the evidence can be excluded entirely or given reduced weight by the jury, because the court cannot confirm nobody tampered with it in the interim.7National Institute of Justice. Law 101: Legal Guide for the Forensic Expert – Chain of Custody Cases fall apart here more often than people expect. The technical analysis can be flawless, but if the custody log has a two-day stretch where no one documented who had the hard drive, opposing counsel will move to suppress everything that came from it.
The log and the hash values reinforce each other. Custody documentation shows who could have touched the evidence; the hash proves whether they did. Together they answer the two questions the court will ask: is this the same item that was seized, and is its content unchanged since seizure?
Authentication Under Federal Rule of Evidence 901
Federal Rule of Evidence 901 requires the party offering electronic evidence to produce “evidence describing a process or system and showing that it produces an accurate result.”8Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence In practice, the forensic examiner testifies about the imaging process, the write blocker used, the hash verification results, and the chain of custody. That testimony, combined with the documentation, satisfies the court that the digital evidence is what the offering party claims it to be.
Each earlier step in this workflow feeds directly into the Rule 901 showing. The write blocker addresses whether the original was altered. The image format and the tool’s inclusion in NIST’s testing program address whether the acquisition method is reliable. The hash values address whether the working copy still matches. The custody log addresses whether unauthorized hands touched the evidence between seizure and courtroom. An examiner who documents each of these can meet authentication on the strength of the record alone.
Preservation Duties and Spoliation Sanctions
Preservation is not only the examiner’s problem. Once litigation is reasonably anticipated, the parties themselves owe a duty to preserve relevant electronic evidence. When a party destroys or fails to preserve that evidence, courts impose sanctions under Federal Rule of Civil Procedure 37(e). The rule creates a two-tier framework based on intent.
If evidence was lost because a party failed to take reasonable preservation steps and the loss prejudiced the other side, the court can order measures to cure that prejudice, such as monetary penalties or reopening discovery. If the court finds the party acted with intent to deprive the opponent of the evidence, the available sanctions escalate sharply: the court can presume the lost evidence was unfavorable, instruct the jury to draw that same negative inference, or dismiss the case or enter a default judgment outright.9Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
The adverse inference instruction alone can effectively end a lawsuit. When a judge tells a jury it may assume deleted emails would have hurt the party who deleted them, the case dynamics shift dramatically. Organizations that anticipate litigation should implement a litigation hold immediately, suspending any automatic deletion policies for relevant data. Failure to do so is exactly the conduct that triggers these sanctions.
The forensic examiner is often the person who documents whether preservation actually happened. Timeline reconstruction from system logs and metadata can show when files were deleted, whether automatic retention rules kept running after a hold notice went out, and whether the pattern of deletions suggests intent rather than routine housekeeping.
Where the Standard Imaging Workflow Runs Into Limits
The write-blocker-and-hash workflow described above is built around traditional storage: hard drives and other removable media the examiner can physically connect to a workstation. Several categories of evidence don’t fit that model cleanly, and the searcher should know the boundaries.
Encrypted Drives
Full-disk encryption tools like BitLocker and FileVault render an entire storage volume unreadable without the correct key. When an examiner encounters an encrypted drive, the forensic image is useless without a decryption method. Several approaches exist depending on the specific encryption implementation. Hardware-based techniques can intercept the encryption key during boot by exploiting the communication between the system’s security chip (TPM) and the processor.10Digital Forensic Research Workshop. Forensic Method for Decrypting TPM-Protected BitLocker Volumes Using Intel DCI Cold boot attacks attempt to extract keys from RAM after a hard reset. Direct memory access through physical interfaces like Thunderbolt can bypass operating system protections. Each method has significant technical prerequisites and none is guaranteed to work on every system, which is another reason capturing volatile memory before shutdown matters so much.
Mobile Devices
Phones and tablets present distinct challenges. Storage is almost always encrypted by default on modern devices, the operating systems restrict access far more aggressively than desktop systems, and the sheer variety of hardware makes standardized approaches difficult.
Extractions come in tiers. A logical extraction pulls data accessible through the device’s standard interfaces: call logs, text messages, contacts, media files. A full file system extraction captures the complete directory structure, including application databases that store deeper artifacts like location history, health data, and encrypted credential stores. A physical extraction creates a raw bit-stream image of the entire storage chip, giving access to deleted data in unallocated space, but it is increasingly difficult on modern devices where hardware-level encryption protects the storage.
The device’s lock state matters enormously. A phone that is powered on and has been unlocked at least once since its last reboot (called “after first unlock”) exposes far more data to extraction tools than one that has just been powered on and never unlocked. Best practice for a seized phone is to keep it powered on and isolated from network signals using a Faraday bag, preserving its state while blocking any remote wipe command.
Cloud and Remote Data
An increasing share of relevant evidence lives on remote servers operated by cloud providers. Email in a hosted platform, files synced to cloud storage, and collaborative documents exist beyond the reach of traditional imaging. Obtaining them requires legal process directed at the provider. Under the Stored Communications Act, the government generally needs a warrant to compel disclosure of the contents of stored electronic communications that have been in storage for 180 days or less. For communications stored longer than 180 days, or for non-content records like login timestamps and IP addresses, a subpoena or court order may suffice.11Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
When the data is stored on servers outside the United States, the CLOUD Act requires U.S.-based providers to comply with valid legal process regardless of where the data is physically located.12Office of the Law Revision Counsel. 18 USC 2713 – Required Preservation and Disclosure of Communications and Records Before the CLOUD Act’s enactment in 2018, providers could argue that U.S. warrants did not reach data stored in foreign data centers.
Cloud platforms also generate their own artifacts: audit logs capture login events, file access, permission changes, and administrative actions. These logs have finite retention periods that vary by provider and licensing tier. For major enterprise platforms, default audit log retention can be as short as 90 days, with extended retention requiring higher-tier licensing. Investigators who wait too long to issue a preservation request risk losing critical log data permanently. Once exported, the logs get the same hash verification and chain of custody treatment as any other digital evidence. The key difference is that the investigator never has physical access to the underlying hardware, which makes meticulous documentation of the collection method even more important for admissibility.