How to Preserve Digital Evidence: Proving Integrity, Provenance, and Chain of Custody

In all workflows, the common thread you will see is how an individual must establish a fact, defend a conclusion, or demonstrate that a required process was followed - using records as proof. It connects with the concepts of evidence, storing it, and probative value.

They all are evidence-driven workflows where businesses must reconstruct events, establish accountability, demonstrate that obligations or controls were satisfied, and produce defensible proof to an internal or external decision-maker.

The consequences of inadequate preservation are real. In September 2022, the U.S. Securities and Exchange Commission announced enforcement actions against 16 Wall Street firms for widespread failures to maintain and preserve electronic communications. The firms agreed to pay more than $1.1 billion in combined penalties. The SEC said that the failures deprived its investigators of communications that should have been available during regulatory investigations.

In 2023, another 11 firms were charged for failures to maintain and preserve electronic communications, with the firms agreeing to pay a combined $289 million in penalties. The SEC described these failures as violations of federal securities-law recordkeeping requirements and again emphasized the importance of preserving electronic communications for regulatory oversight and investigations.

And the risks also extend beyond regulatory recordkeeping. In the United Kingdom, the High Court found Raymond McKeeve to be in contempt of court after electronic material was destroyed in circumstances where preservation obligations applied. The court subsequently imposed a £25,000 fine and made significant costs orders. Ocado, the entity, reported that its legal costs had reached approximately £1.1 million. Mr. McKeeve, the individual involved, incurred approximately £615,000 in defence costs.

Recordkeeping and digital evidence preservation are closely connected. Recordkeeping maintains reliable organizational records; evidence preservation protects information that may later be needed to establish what happened.

The lesson is simple: do not just keep digital information - preserve it so you can prove what it is and why it can be trusted when it matters.

The purpose of an enterprise evidence-preservation SOP is to establish a small set of mandatory controls that protect the integrity, authenticity, traceability, and reproducibility of evidence from the moment it is identified through its eventual presentation or disposition. The three principal sources of guidance used to create this SOP and that you can consult to create your own, are the:

• ISO/IEC 27037:2012 Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence;
• Scientific Working Group on Digital Evidence’ (SWGDE) Best Practices for Digital Evidence Collection (and 17-F-002-2.1, 18-F-002-2.0, 21-F-001-1.1, 23-F-004-1.1);
• NIST SP 800-86’ Guide to Integrating Forensic Techniques into Incident Response and NIST IR 8387 Digital Evidence Preservation - Considerations for Evidence Handlers.

Your governing rule should be: Never modify what you cannot replace; never transfer what you cannot trace; never rely on evidence whose integrity you cannot verify.

This is not intended to replace specialized forensic procedures. SWGDE expressly notes that its best-practice documents are not training manuals, are not all-inclusive, and may not apply to every circumstance. Where a situation requires deviation, the deviation and actions taken should be thoroughly documented.

Every transfer of evidence should be traceable to a unique evidence identifier and should record, at minimum, who transferred it, who received it, when the transfer occurred, and why it occurred. SWGDE 17-F-002 explicitly identifies these elements as the minimum chain-of-custody information for digital evidence transfers. The objective is not bureaucratic complexity. It is continuity. At any point, the organization should be able to answer:

• Where is the evidence?
• Who has custody?
• When did custody change?
• Why did it change?
• Was its integrity verified?

If those questions cannot be answered, the evidence management process has a traceability gap.

Note that the strength of an SOP is that the controls remain stable while the implementation becomes more sophisticated. A small organization might use a controlled evidence register, standardized acquisition forms, cryptographic hashing, encrypted storage, and documented custody transfers. A larger enterprise can progressively add role-based access control, immutable or write-protected evidence repositories, automated hash verification, tamper-evident audit logs, etc. The important point is that these capabilities extend the initial controls rather than replacing them.

Consult the Reference framework for all the content and other specific use cases that may better fit your own workflow.

To start working, it’s also important to consider common challenges that you may face, even if there’s a plan in place.

The goal is always to face these challenges and turn digital evidence into a record the business can verify, explain, and defend.

In the evidence-preservation workflow, we work with the “Fingerprint” and “Verify” stages: creating a cryptographic hash of the preserved record, securely establishing that hash at a known point in time, and later verifying that the record still matches. Connecting Software’s Truth Enforcer fits this specific requirement: it creates a cryptographic fingerprint of a file and records it in an immutable blockchain ledger, allowing the file to be checked later for changes without the underlying document leaving the organisation’s control.

Truth Enforcer could provide one discrete integrity control within those workflows: establishing and subsequently verifying the state of a record.