Chapter 3 — Authorized practice and evidence handling | Professional Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Written authorisation"]
  N2["3.2 Confidential data"]
  N3["3.3 Handling evidence"]
  N4["3.4 Chain of custody"]
  N5["3.5 Reporting findings"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Written authorisation"]
  N2["3.2 Confidential data"]
  N3["3.3 Handling evidence"]
  N4["3.4 Chain of custody"]
  N5["3.5 Reporting findings"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Written authorisation]
    |
    v
[3.2 Confidential data]
    |
    v
[3.3 Handling evidence]
    |
    v
[3.4 Chain of custody]
    |
    v
[3.5 Reporting findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) work within written authorisation; (2) handle evidence and confidential data; (3) maintain chain of custody.

3.1 Written authorisation

Before reviewing anything at Oakline, Grace receives a written authorisation from the IT manager and a partner. It lists what she may review (firewall and VPN configurations, logs and wireless settings, all exported by the IT team), what she may not do (access case files, test live systems or contact clients) and the reporting route for findings. If a task needs anything outside the authorisation, she stops and asks. Written authorisation protects the firm, the academy and Grace from misunderstandings.

3.2 Confidential data

Logs and configurations at a law firm can reveal client names, matter numbers and lawyers' movements. Grace receives only sanitised exports where possible, with client identifiers removed by the IT team. Files are stored on the academy's encrypted storage, accessed only by Grace and Sam, and deleted at the end of the engagement. She never copies files to personal devices or shares them in chat tools. These measures meet both the firm's confidentiality duties and data protection obligations. Sam confirms these arrangements before files arrive.

3.3 Handling evidence

When Grace finds something important, such as an unusual login pattern, she preserves the evidence: the original log extract, the time she obtained it, who provided it and a SHA-256 digest of the file so any later change can be detected. She works on copies, leaving originals untouched. This discipline matters if a finding later becomes part of an incident investigation or a disciplinary matter, where the reliability of evidence may be questioned. Copies are clearly labelled as working copies, and the originals are stored read-only with their digests alongside.

3.4 Chain of custody

A chain of custody records who held evidence, when and why, from collection to final use. Grace keeps a simple custody log for each evidence item: received from whom, stored where, accessed by whom and transferred to whom. For most review work, this is light-touch, but the habit means she is ready if a matter escalates. Courts and regulators place weight on evidence whose handling can be shown, and a law firm, of all organisations, values such care. Entries are dated and signed off by Sam.

3.5 Reporting findings

Findings go through the agreed route: to Priyanka first, with urgent issues reported by phone the same day. Grace states facts, evidence and recommended actions, and avoids speculation about who might be responsible. If she accidentally sees confidential client data, she reports that too. Honest, prompt, discreet reporting is a core professional behaviour; it lets the firm act quickly and preserves trust in the person doing the review. Each report is logged with its date, recipient and the response received, so follow-up actions can be tracked until they are closed.

Worked example

Grace's evidence log for one unusual login includes source, time, digest and two custody entries.

Synthetic case. Evidence is synthetic.

Errors and limits

Working on original evidence files risks altering them and weakening their reliability.

Exercises

EX011 — Not permitted. Name two activities outside Grace's authorisation. Rubric: 3 = access case files, test live systems, contact clients;; 2 = two;; 1 = one;; 0 = none.
EX012 — Digest purpose. Why record a digest of an evidence file? Rubric: 3 = detect later changes;; 2 = integrity;; 1 = encryption;; 0 = none.
EX013 — Custody log contents. What does the custody log record? Rubric: 3 = who held evidence, when, where, why;; 2 = holders;; 1 = vague;; 0 = none.
EX014 — Urgent finding route. How are urgent findings reported? Rubric: 3 = phone to IT manager same day;; 2 = phone;; 1 = email later;; 0 = none.
EX015 — Accidental exposure. What should Grace do if she sees client data by accident? Rubric: 3 = report it;; 2 = report;; 1 = ignore;; 0 = none.

Synthesis

Authorisation, careful data handling and documented custody make practitioner work trustworthy.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →