Mobile Forensics · Forensics Foundations · Lesson 2 of 5

Evidence & Chain of Custody

Track every hand that touches a phone, and know what gives you the right to look.

Who touched it, and when

Imagine a phone shows up in court as evidence. The other side asks a simple question: how do we know this is the same phone, and that nobody changed it along the way? The answer is the chain of custody.

NIST defines it as a process that tracks evidence through collection, safeguarding and analysis by recording each person who handled it, the date and time it was collected or transferred, and the purpose of each transfer. In practice it's usually a form that travels with the evidence bag. Every time the phone changes hands, someone signs and notes the time.

A typical record includes:

• A description of the phone, such as make, model, color, case and visible damage, plus serial number or IMEI (the phone's hardware identity, from Mobile Networking) when it can be read without changing anything
• Where, when and by whom it was collected
• Each transfer: from whom, to whom, when and why
• How it was packaged and sealed, and where it was stored

A gap, such as a day nobody can account for, gives the other side room to argue the evidence may have been swapped or tampered with. That can weaken it or get it excluded.

Custody is one part of a wider habit: documentation. Good examiners take contemporaneous notes, meaning notes written at the time, not from memory later. They photograph the phone where it was found and record what they did and when.

Behind all of this is one principle. Don't change the evidence. With phones that isn't always fully possible, because even connecting a cable can make small changes. So the rule becomes: change as little as you can, and document anything you do change, and why. A change that's written down and explained can be judged fairly. An unexplained one raises doubt about everything.

The right to look

Before anyone examines a phone, they need legal authority. Without it, even a perfect examination may be thrown out, and the examiner may be breaking the law. The rules vary a lot by country. This track uses the US as its main example, but always check local law and your organization's policies.

The common sources of authority are:

• A warrant. A judge's order allowing a search, based on evidence that it's likely to turn something up. A warrant has a scope, a description of what may be searched for, such as messages between two dates.
• Consent. The owner or user agrees to the search. Consent can be limited to certain data, and it can usually be withdrawn.
• Organization-owned devices. A company or agency can usually examine phones it owns and issues, under policies employees agreed to. That doesn't extend to an employee's personal phone.

In the US, the key case is Riley v. California, decided by the Supreme Court on June 25, 2014. Police had searched the phones of people they arrested without a warrant. The Court ruled unanimously that the data on a phone is different from a wallet or a pack of cigarettes in a pocket, because of how much of a person's life it holds. Its answer to what police must do was simple: get a warrant. The Court left room for case-by-case exceptions, such as a real emergency.

Scope matters after the search starts, too. NIST notes that when a warrant covers only text messages, an examiner may still make a full copy of the phone, but should report only what the warrant covers. Seeing private photos or health data outside the scope doesn't make them fair game.

Authority isn't paperwork for its own sake. It protects the people whose lives are on the phone.