Forensic acquisition of digital evidence
Almost every piece of digital evidence that collapses in court collapses here, at the first step: someone copied data in a way that cannot be demonstrated, or altered it while copying it.
The problem acquisition solves
Digital data differs from a paper document for one elementary reason: it can be altered without leaving a visible trace. Switching on a seized computer changes dozens of system files; opening a mailbox with an ordinary client marks messages as read and may re-download them, altering their metadata; attaching a disk to a Windows machine results in something being written to it almost immediately.
Forensic acquisition produces a copy that can be shown, at any later time, to be identical to the original as it stood when it was taken. From then on the work is done on the copy and the original is not touched again.
How I proceed
Physical media: disks, memory cards, USB sticks
A bit-for-bit image is made of the whole medium, including unallocated space — where deleted but not yet overwritten files live. Reading is done through a write blocker, hardware or software, that physically prevents the system from modifying the original. At the end the hash of the image and that of the source are computed: if they match, the copy is complete, and that value becomes the reference for every future check.
Where the medium is damaged or degrading the rule changes: the priority becomes saving what is still readable before it stops being readable, and the partial nature of the copy must be documented sector by sector, not passed over in silence.
Mailboxes and cloud archives
Here there is no medium to copy: there is a service that answers requests. Acquisition proceeds through the service's own protocols, preserving messages in their original format with all technical headers intact — the part that carries evidential weight, and the part almost every «convenient» export loses along the way. The result is then treated as a medium: hash, record, seal.
What the provider retains, and for how long, must also be checked. Many services keep access records for short windows only: if they are needed they must be requested at once, and the request documented even when it is refused.
Web pages and online content
A page published today may not exist tomorrow, and a screenshot does not prove that it did. Acquiring online content documents the whole session: the address requested, the response returned by the server, the network addresses involved, the date and time taken from an independent source, and the full content rather than just the portion visible on screen. The whole is closed with the usual integrity verification.
The record
Every acquisition produces a written record stating date and time, place, persons present, description and identifiers of the material (make, model, serial number), tools used with their versions, procedure followed, hash values computed and the algorithm used, and any anomalies encountered. It is the document that makes it possible, months later, to answer a challenge to the material's authenticity in a verifiable way.
Frame of reference
Technically, the international reference is ISO/IEC 27037, which describes the identification, collection, acquisition and preservation of digital evidence and distinguishes the role of those who collect from those who examine.
Procedurally, Italian law 48 of 2008 — which ratified the Budapest Convention on Cybercrime — introduced into the Code of Criminal Procedure the principle that operations on computer systems must adopt technical measures directed at preserving the original data and preventing its alteration. It is the statutory basis on which a badly conducted acquisition is challenged.
If the acquisition has already happened. I am often asked to come in afterwards: the material has already been copied, perhaps badly, perhaps by someone with no reason to be careful. In that case the work is not to re-acquire — usually no longer possible — but to establish what that copy can still support and what it can no longer support. That too is a useful answer.
Further reading: forensic imaging and
hashing →
Further reading: audio recordings as
evidence →
Related areas
Mobile devices
Extraction from smartphones and tablets: what can be recovered, what cannot, and why.
Email and certified email
Reading SMTP headers, SPF, DKIM and certified-email receipts to establish who really sent what.
Data breaches and log analysis
Reconstructing an intrusion from the logs and separating what was taken from what was merely reachable.
Do you have a matter under way?
Tell me what happened and what you need to prove. In a first reply I will tell you whether there is a technical route, what data is needed and how long it takes — before any commitment.