Title: 7. Storing Digital Evidence
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Storing Digital Evidence

1. The media you use to store digital evidence usually depends on how long you need to keep it.
2. The ideal media for storing digital evidence are CD-Rs and DVDs. You can also store your digital evidence in magnetic tapes.
3. Magnetic tapes have more capacity and a longer lifespan than CD-Rs and DVDs, but they are much more expensive as well.

Evidence Retention and Media Storage Needs

1. To help maintain the chain of custody for digital evidence, you should restrict access to your lab and evidence storage area.  Your lab should also have a sign-in roster for all visitors.  These logs should be maintained for a period based on legal requirements.  See Figure 5-7.
2. If you need to retain evidence indefinitely, you must check with your local prosecuting attorney’s office or state laws to make sure you’re in compliance.

Documenting Evidence

1. To document evidence, you can create or use an evidence custody form. An evidence custody form serves the following functions:
  - Identifies the evidence
  - Identifies who has handled the evidence
  - Lists dates and times the evidence was handled
2. You can add more information to your form, such as a section listing MD5 and SHA-1 hash values.  Include any detailed information you might need to reference.  Evidence bags also include labels or evidence forms you can use to document your evidence.