Step 5, Complete Chain of Custody Form Each team member should complete a chain of custody form for digital evidence. That evidence from the eDiscovery process should include digital material taken from devices and media, as well from systems and hardware. This form will follow all digital evidence in this project. The chain of custody form will track dates and times, locations, and dispositions of devices that hold digital evidence.
Take Note
Chain of custody deals with the collection and maintenance of evidence. You will need to use your best judgment in determining items that would be included on the chain of custody form, including hardware devices, storage devices, personal and mobile devices, and other items associated with criminal cyber activity.
In the field of digital forensics, standards may be published by open consortia, closed consortia, government agencies or proprietary, such as tool-specific. It is a best practice to conduct an investigation aligned with established standards. Make sure you maintain consistency with all legal systems, allow for the use of a common language, provide durability to cross international boundaries, and instill confidence in the integrity of evidence.
Read more about chain of custody if you are not familiar with this concept.