◇ OpenCyber Academy
Bachelor's · Chapter 15 · English

Chapter 15 — Evidence and measurement

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Evidence and measurement

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Reliability"]
  N2["15.2 Acquisition"]
  N3["15.3 Verification"]
  N4["15.4 Chain of custody"]
  N5["15.5 Measurement uncertainty"]
  N6["15.6 Repeatability and reproducibility"]
  N7["15.7 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Reliability"]
  N2["15.2 Acquisition"]
  N3["15.3 Verification"]
  N4["15.4 Chain of custody"]
  N5["15.5 Measurement uncertainty"]
  N6["15.6 Repeatability and reproducibility"]
  N7["15.7 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Reliability]
    |
    v
[15.2 Acquisition]
    |
    v
[15.3 Verification]
    |
    v
[15.4 Chain of custody]
    |
    v
[15.5 Measurement uncertainty]
    |
    v
[15.6 Repeatability and reproducibility]
    |
    v
[15.7 Documentation]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) explain what makes digital evidence reliable; (2) apply hashing and documentation to preserve it; (3) measure and record acquisition properly; (4) describe chain of custody.

15.1 Reliability

Evidence must be relevant, reliably acquired and preserved, and its handling documented. ISO/IEC 27037 sets out principles for identification, collection, acquisition and preservation, including auditability and repeatability.

In practice this means every step from seizure to report can be traced: who did what, with which tool, and what came out. Auditability lets a reviewer follow the trail; repeatability lets someone redo a step and get the same result. The ws-114 acquisition record is Leah's first exercise in checking whether a real record meets these principles.

15.2 Acquisition

ws-114's disk is imaged through a write blocker. The image's SHA-256 is computed during acquisition and recorded with the tool name and version, examiner, time and drive serial number.

Each field has a reason: the tool version links to known behaviour and bugs, the examiner and time establish who acted when, and the drive serial ties the image to one physical disk. A hash computed during acquisition, rather than afterwards, closes the gap in which the image could have changed unnoticed.

15.3 Verification

Before analysis, the working copy's hash is recomputed and compared with the acquisition value. A match shows the copy is unchanged.

If the hashes differ, analysis stops until the cause is found, whether a corrupted copy or a damaged disk. Leah also verifies after copying the image to a new storage device and before handing it to another examiner. Each verification is logged with the time and the hash value, so the record shows an unbroken sequence of matches from acquisition onward.

15.4 Chain of custody

A custody record lists each person who held the drive, when, and why. Seals and their numbers are recorded at each transfer.

A gap in the record, such as a night when nobody can say where the drive was, gives an opposing party grounds to argue that it might have been altered. The hash can show that the image did not change, but custody records show that the physical drive was controlled. Grace's team uses a numbered seal and signs at each handover.

15.5 Measurement uncertainty

Some measurements carry uncertainty: clock offset estimates, file-size rounding, time resolution. Reports state them.

For ws-114, the clock offset of 47 seconds came from one photograph of the BIOS clock beside a reference, so its precision is about a second and it assumes the drift was constant over the incident period. Stating both points lets readers judge how much a timeline built on corrected times can be trusted, especially where two events are close together. A second measurement at another time would show whether the drift was steady.

15.6 Repeatability and reproducibility

Repeatability: the same examiner gets the same result with the same method. Reproducibility: another examiner with another validated tool gets consistent results. Both build confidence.

For ws-114, Leah repeats her extraction of the run key and gets the same value; a classmate using a different validated tool reports the same key, data and timestamp. Agreement between tools makes it unlikely that a tool bug produced the finding. Where tools disagree, the difference is investigated and explained before the finding is reported.

15.7 Documentation

Notes are contemporaneous, dated and signed or otherwise attributable.

Contemporaneous means written at the time, not reconstructed from memory days later. Leah's notebook records each action with a time, such as "10:40 verified working copy, hash matches". If an entry is corrected, the original stays readable with the correction beside it. These notes are the basis of any later statement she might be asked to make about her work, perhaps long after details have faded from memory. Notes kept on loose paper or in personal chat messages do not meet this standard.

Seals and photographs

Physical evidence bags are sealed with numbered tamper-evident seals. Photographs of the device, its labels and the seal at each stage add visual proof of condition and continuity. Leah checks that seal numbers in the photographs match the custody record.

Worked example

Leah reviews the ws-114 acquisition record: tool and version, SHA-256, examiner, start and end times, write blocker model, drive serial. One field is missing: the workstation clock offset. She asks Grace's team; they had photographed the BIOS clock beside a reference clock, showing ws-114 ran 47 seconds slow. The offset is added to the record.

Synthetic case. The record is invented.

Errors and limits

Hashes prove copies match; they say nothing about whether the right device was seized or the acquisition was complete.

Exercises

Synthesis

Reliable evidence comes from documented acquisition, verified copies, custody records and stated uncertainty.

Continue studying — chapter 15 of 40

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →