Do we have full control over integrity in digital evidence life cycle?

Chain of custody plays an important role in digital forensic investigation. Contact with different variables occurs through a life cycle of digital evidence. To prove chain of custody, investigators must know all details on how the evidence was handled every step of the way. „Five WS (and one H) must be applied. Life cycle of digital evidence is very complex, and at each stage there is more impact that can violate a chain of custody. This paper presents a life cycle of digital evidence and problems with implementation of chain of custody in digital investigation. The authors also warn of certain shortcomings in terms of answering specific questions, and give some recommendation for further research. New framework based on Five WS will be presented.

Download PDF