What is continuity of digital evidence?¶

Continuity of digital evidence is the documented history showing what the item or material was, where it came from, who handled it and what happened to it.

Avoid this assumption: Continuity is satisfied by putting a device in a bag and assigning an exhibit number. Digital material may also be copied, exported, transferred, opened, converted, uploaded or processed.

Record the source item, device, account, provider, system or person from which the material originated.

Capture identifying details such as serial numbers, filenames, account IDs, URLs, case references and timestamps.

Record every person who received, handled, transported, stored, accessed or transferred the material.

Document each action, including packaging, connection, export, copying, imaging, conversion, review and return.

Preserve the date, time, location, method, tool and purpose where relevant.

Keep the original item or source separate from working copies and derived material.

Do not rename, edit or overwrite files without recording the change.

Where a copy is created, record what was copied, from where, by whom and whether the process may have altered metadata or format.

Continuity does not prove the content is true or identify the person responsible.

It supports confidence that the material being examined is the same item or data that was originally obtained and that changes are accounted for.

Where the history is incomplete, record the gap rather than inventing certainty.

Operational takeaway¶

Maintain a complete handling and transformation history for every device, file, export and copy so the evidence can be identified, traced and distinguished from later changes.