Digital Evidence Handling and Forensic Imaging in the Lab — Crime Scene / Forensic Technician

Objective. Students will acquire a forensic image of a provided storage device using a write blocker, verify image integrity with a hash value, and document the process on a chain-of-custody and examination worksheet.

Why Digital Evidence Demands Special Handling

Digital storage devices — USB drives, hard drives, SD cards, mobile phones — are fragile evidence. Simply plugging an unprotected drive into a computer can alter timestamps, write new data, or overwrite files. A single unintended write can make the evidence inadmissible or destroy data the investigation depends on. The forensic technician's job is to capture an exact, verifiable copy of the original without changing it at all. Two tools make that possible: the write blocker and the cryptographic hash.

The Write Blocker

A hardware write blocker is a physical device that sits between the suspect storage device and the forensic workstation. It passes read commands through normally but intercepts and blocks any write commands the computer tries to send. This is the first line of protection for digital evidence.

Before you begin any acquisition:

1. Power off the forensic workstation.

2. Connect the suspect device to the write blocker's evidence port.

3. Connect the write blocker to the workstation's host port.

4. Power on the write blocker first, then the workstation.

5. Confirm the write-protect indicator light is active on the write blocker before opening any software.

If the indicator does not confirm write protection, stop. Do not proceed. Troubleshoot the connection or switch to a known-good unit. Document what happened in your case notes.

Software write blockers exist but hardware write blockers are preferred in court-admissible work because they cannot be inadvertently disabled by an operating system update or user error.

Forensic Imaging

A forensic image is a sector-by-sector, bit-for-bit copy of the entire storage device — not just visible files but deleted files, unallocated space, slack space, and file system metadata. This is different from a normal file copy, which captures only visible files.

Two common image formats are:

E01 (Expert Witness Format): A compressed, segmented format with built-in hash and case metadata. Widely accepted in court and by most forensic tools.
dd (raw format): An uncompressed bit-for-bit image. Simple and universally readable; larger file size.

FTK Imager (and open-source equivalents such as Guymager) walk you through an acquisition wizard. You will enter case information — case number, examiner name, evidence number, notes — before acquisition begins. This information is embedded in the image file and becomes part of the evidentiary record.

Hash Verification: Proving Nothing Changed

A cryptographic hash is a fixed-length string produced by running data through a mathematical algorithm. The two hashes used in forensic imaging are MD5 (produces a 128-bit value) and SHA-1 (produces a 160-bit value). These algorithms are deterministic: the same data always produces the same hash. Change even one bit of data and the hash changes completely.

The acquisition process works like this:

1. The software hashes the source drive before imaging (pre-acquisition hash).

2. The software creates the image.

3. The software hashes the completed image file (post-acquisition hash).

4. If pre-acquisition hash equals post-acquisition hash, the image is a verified, exact duplicate.

Record both the MD5 and SHA-1 values on your examination worksheet exactly as displayed — do not abbreviate or retype from memory. A mismatch means something went wrong: the image is not reliable and the process must be repeated.

Chain of Custody

Chain of custody is the documented, unbroken record of who had an item of evidence, when, why, and what was done with it. A gap in chain of custody gives defense counsel grounds to challenge admissibility.

Each entry on the chain-of-custody form must include:

Date and time
Name and signature of the person receiving or transferring the item
Reason for transfer (receipt, examination, storage, release)
Condition of the item
Evidence identifier (item number, case number)

For this lab you will make three entries: receipt (you signed the device in), examination (you performed imaging), and return to storage (you signed the device back). Every field must be complete. Blank fields are not acceptable — write "N/A" only where the field genuinely does not apply.

Examination Summary

After completing the acquisition, write a two-paragraph examination summary as part of your case documentation. Paragraph one describes the acquisition: what device was examined, what write blocker was used, what imaging software and format were used, and the date and time. Paragraph two states the hash verification result — whether the hashes matched — and the current status of the original device (returned to secure storage, intact, unmodified).

Write in plain, factual language. Avoid opinion. Your summary may become part of a report reviewed by attorneys and courts.

Safety and Lab Conduct

Handle storage devices with care; electrostatic discharge can destroy evidence. Use anti-static mats or bags when available.
Do not connect any personal device to the forensic workstation.
Do not open, modify, or delete any files on the practice drives outside the imaging workflow.
Log out of the forensic workstation at the end of your session.
Follow your lab's data-handling policy for where images are stored and how they are deleted after class.

Following SWGDE (Scientific Working Group on Digital Evidence) best practices is the industry standard for this work and the framework referenced in IAI certification examinations.

Key terms8

Write blockerA hardware or software device that allows read commands to pass through to a storage device while intercepting and blocking all write commands, preventing any alteration of evidence.

Forensic imageA sector-by-sector, bit-for-bit copy of an entire storage device, capturing all data including deleted files, unallocated space, and metadata — not just visible files.

MD5A cryptographic hash algorithm that produces a 128-bit value used to verify that a forensic image is an exact, unaltered copy of the original source.

SHA-1A cryptographic hash algorithm that produces a 160-bit value; used alongside MD5 in forensic imaging to provide a second, independent integrity verification.

E01 formatExpert Witness Format — a compressed, segmented forensic image format that embeds case metadata and hash values within the image file itself.

Chain of custodyThe documented, unbroken record of every person who had possession of an item of evidence, including dates, times, reasons for transfer, and signatures.

Hash verificationThe process of comparing the pre-acquisition hash of the source device with the post-acquisition hash of the image file to confirm that no data was changed during imaging.

SWGDEScientific Working Group on Digital Evidence — the body that publishes best-practice guidelines for the collection, handling, and examination of digital evidence.

In class: Write-blocker setup: each student connects a practice USB drive to a hardware write blocker, confirms write protection is active using the manufacturer's indicator, then opens forensic imaging software (e.g., FTK Imager or open-source equivalent) and walks through the acquisition wizard step by step. · Image acquisition and hash verification: student acquires a forensic image of the practice drive in E01 or dd format, records the MD5 and SHA-1 hash values generated by the software, and verifies that the pre- and post-acquisition hashes match, documenting results on the examination worksheet. · Case log entry: student completes a full chain-of-custody entry for the device including receipt, examination, and return-to-storage entries, then writes a brief two-paragraph examination summary describing the acquisition method, hash verification result, and status of the device.
Materials: Practice USB drives pre-loaded with sample files, hardware write blocker, forensic workstation with FTK Imager or equivalent open-source forensic imaging tool, examination worksheets, chain-of-custody forms, SWGDE best practices reference
Check: Hash values are correctly recorded and pre/post hashes match; chain-of-custody form is fully complete with zero missing fields; examination summary correctly describes the acquisition method and hash result; instructor confirms write protection was maintained; graded pass/fail with all three criteria required to pass.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.