Collecting Data Without Altering It

Preservation and collection are separate operations and are often confused. Preservation stops material from being destroyed and can be accomplished without touching it. Collection takes a copy and moves it somewhere it can be searched and reviewed, and that act, done carelessly, damages exactly the attributes that would have made the material provable.

Why copying changes the record

An electronic record is not only its visible content. The file system stores creation, modification and access times; a message store records routing information, participants and thread structure; a document may carry authorship, revision history and tracked edits inside the file itself. Together these establish when something existed and who touched it.

Ordinary copying disturbs several of them. Dragging a folder to an external drive typically writes new creation times on the copies, so the produced set reports the date of the copying rather than the date of the document. Opening a file before copying it can update the access time on the original. Neither is intentional and both are difficult to reverse.

Cloud systems shift the problem rather than removing it. An administrative export from a mail or collaboration platform generally preserves routing data and timestamps, because the platform records them independently of any file system. What it may not preserve is the version history of a document edited in place, or the membership of a channel at the time a message was sent, and those are recoverable only if the export is configured to include them.

The consequence appears late. A production whose dates are unreliable invites a challenge to the whole set, and the answer — that the dates reflect a collection step, not the underlying events — requires a witness who can describe what was done. Where nobody recorded what was done, the answer is not available.

Three methods and what each captures

Collection methods sit on a spectrum from exhaustive to expedient. A full forensic image duplicates a storage device at bit level, including deleted areas and unallocated space, and is the only method that recovers artifacts of deletion. Targeted collection extracts defined items — accounts, applications, folders, date ranges — with their metadata intact. Self-collection asks custodians to gather their own material.

Self-collection attracts the most criticism, and the reasons are structural rather than moral. A custodian cannot search what he does not remember, applies his own view of relevance without a record of the exclusions, and works through tools that alter attributes. Even a conscientious custodian produces a set whose completeness cannot be demonstrated afterward.

Metadata and the form of production

The form in which material is produced is governed by rule. Where a request does not specify a form, a party must produce electronically stored information in a form in which it is ordinarily maintained or in a reasonably usable form, and need not produce the same information in more than one form. Parties routinely agree the form in advance, which is the cheapest way to avoid a second production.

Native files retain the most. A spreadsheet produced natively carries its formulas, hidden columns and revision data; the same spreadsheet produced as a flat image carries a picture of one view of it. Load files supply the metadata fields alongside images where native production is impractical, and the fields to be included are the usual subject of the parties' protocol.

Some metadata is unhelpful and some is sensitive. Location data attached to photographs, contact lists pulled alongside messages, and health application records on a device are all common in collections from hardware an employee owns. The protocol handles this by defining the fields collected rather than by relying on later review to catch them.

Verifying that the copy matches the source

Acquisition is verified mathematically. A hash value computed across the source, and recomputed across the copy, will differ if a single bit changed. Federal guidance on forensic acquisition treats the computation and recording of that value as a standard step, and the tools used to perform acquisitions are tested against published specifications under a federal testing program.

Write blocking is the companion control. A hardware or software write blocker allows a source device to be read while preventing anything from being written back to it, which is what makes it possible to say that the acquisition did not alter the original. Both the blocker and the acquisition tool are recorded in the examiner's notes.

Not every source can be acquired this way. A live system that cannot be taken offline, a service reachable only through an application interface, and a device with encrypted storage each require methods that produce a logical rather than a physical copy. Those methods are accepted, but the acquisition record has to state which was used, because the difference determines what could and could not have been captured.

Verification also has a practical role during a case. Where a produced set is challenged as incomplete or altered, recomputing the hash against the preserved acquisition answers the question directly. Without it, the argument becomes a contest of recollection between people who handled the data at different times.

The chain-of-custody record

A chain of custody is a log, not a concept. It records each item acquired, the identifiers of the source, the date and person performing each transfer, the storage location between transfers, and the verification values at each step. It is maintained because a copy is only as good as the account of how it traveled.

Organizations tend to keep such records well for devices and badly for cloud exports, where an administrator produces a file, places it on a shared drive, and the trail ends. The same discipline applies: who ran the export, against what scope, on what date range, and where the output was stored. That record is also what allows a hold to be lifted safely, because it shows what has already been captured before the release of the hold returns systems to normal deletion.

Where a collection is challenged, the log is what the examiner testifies from. Gaps in it do not automatically exclude the material, but they invite an argument about handling that runs alongside the argument about content, and in a case where material has already gone missing they compound the difficulty of resisting the measures available for lost electronic evidence.