The Chain of Custody

In forensics, how you collect evidence matters as much as the evidence itself.

Non-negotiables

• **Write blockers** prevent accidental changes during acquisition.
• **Hashing** proves integrity before and after imaging.
• **Documentation** records every action, handler, and timestamp.
• **Repeatability** ensures another examiner could follow your path without interpretive dance.

Professional truth

If you cannot explain where the evidence came from, who touched it, and whether it changed, you do not have evidence. You have a problem wearing a name tag.