What is continuity of digital evidence?¶

Continuity is the documented history that identifies digital evidence, traces its source and custody and accounts for every handling or transformation from collection onwards.

Digital continuity covers data as well as objects¶

A bagged device needs serial numbers, labels and transfer records, but files and exports can also be copied, converted, uploaded, processed and reviewed. Record the originating device, account, provider, system or person and identifiers such as filenames, account IDs, URLs, references and timestamps.

For each action, document who, when, where, why and - where relevant - the method and tool. Keep sources, preservation copies, working copies and derivatives distinct. Renaming, conversion or other alteration should remain traceable rather than silently replacing the prior form.

Continuity supports identity, not truth¶

When a copy is created, record its source and scope and whether metadata or format may have changed. Every custodian, storage location, access and handover should be capable of explanation. If a gap exists, disclose it.

Continuity supports confidence that the item examined is the one obtained and that subsequent changes are accounted for. It does not prove that its content is accurate or identify the person responsible.