What Should You Learn NextNot sure where to start? Take the free What Should You Learn Next quiz
What Should You Learn NextNot sure where to start? Take the free What Should You Learn Next quiz
What Should You Learn NextNot sure where to start? Take the free What Should You Learn Next quiz
What Should You Learn NextNot sure where to start? Take the free What Should You Learn Next quiz
What Should You Learn NextNot sure where to start? Take the free What Should You Learn Next quiz
Take the Skills Quiz →

Free preview: What counts as digital evidence — Digital Forensics & Incident Response

Free preview lesson · Digital Forensics & Incident Response · Module 1: Evidence and chain of custody

What counts as digital evidence

Evidence that cannot be trusted is worthless. Chain of custody is the record that shows evidence was collected and handled without alteration.

What to record

Who collected the item, when, where, how, and every hand-off afterwards.

Preserve before you analyse

Work from verified copies and record hashes so you can prove nothing changed.

Keep it simple

A consistent form used every time beats a perfect process nobody follows.

Common pitfall

Analysing the original device instead of a verified copy.

Action step

Create a one-page chain-of-custody form you could use tomorrow.

This is one lesson from Digital Forensics & Incident Response.

Enroll now — $97 See the full curriculum

Educational content only. No income, revenue or earnings results are promised or implied. No certification, licence or professional credential is awarded.

Editorial & AI Disclosure