🛡️ Security

Chain of Custody

A documented record of who handled a piece of evidence, when, and how, from the moment it was collected until it is presented. Disk images and logs taken from a compromised device without chain-of-custody records may be unusable in legal or regulatory proceedings.

📚 Deep Dive

Learn Article

How to Preserve Forensic Evidence on a Network Appliance Before You Patch It

A firmware upgrade erases memory, rotates logs, and overwrites the artifacts that prove a breach. A step-by-step capture procedure for appliances, built on CISA's forensic-triage requirement.

intermediate 6 min read

Back to Glossary