Re: Sample Chain of Custody Document

From: Baker,David W. (bakerdat_private)
Date: Fri Apr 27 2001 - 04:11:53 PDT

  • Next message: Steve Romig: "Re: forensics at usenix"

    I forgot one important reference.  There is a regulation, AR 195-5,
    which explains in great detail, the procedures that MUST be followed
    both in collecting and maintaining custody of the evidence, which insure
    the chain of custody is valid.  You can find it here:
    
    http://www.usapa.army.mil/pdffiles/r195_5.pdf
    
    It covers collection, control, accountability, release and destruction
    procedures, as well as standards for evidence storage facilities, etc.
    An excellent resource if you want detailed, precise standards for such
    matters.  I apologize for having to post twice, I don't know how I
    forgot this the first time.
    Sincerely,
    Dave B.
    
    David Baker wrote:
    >
    > Michael Deyo wrote:
    > >
    > > I am wondering if anyone could supply me with a sample Chain of Custody
    > > document template.  I am attempting to build this document for a growing
    > > forensic practice, and any assistance would be greatly appreciated.
    >
    > Here is a standard form, used by the US Army since Christ was a
    > corporal.  It has successfully been used in a variety of court
    > proceedings, and has withstood all manner of scrutiny.  The form is not
    > really what ruins chain of custody, however, it is the person handling
    > evidence that either fails to properly safeguard it, or is just plain
    > lazy about documenting what they do.  Anyway, you can look at the form
    > here:
    >
    > ftp://pubs.army.mil/pub/eforms/pdf/a4137.pdf
    >
    > There are plenty of places to document changes from one person to
    > another, and if you run out of signature places, you use a second form,
    > and write continuation page ___  and NOT USED in the description part,
    > and keep on trucking.  Some of the form blocks are not necessarily
    > intuitive, but most are, and you can get the Army's way of filling out
    > the form, and what the fields are intended to be used for here:
    >
    > http://www.adtdl.army.mil/cgi-bin/atdl.dll/fm/19-20/ch12.htm#s9
    >
    
    --
     ------------------------------------------------------------
     David W. Baker                            bakerdat_private
     Lead INFOSEC Engineer
     G023 - Secure Information Technology      (703) 883-3658
     The MITRE Corporation                     (703) 883-4589 (F)
     Mailstop W435
     1820 Dolley Madison Blvd                  McLean, VA, 22102
     ------------------------------------------------------------
     "Cyberspace. A consensual hallucination experienced daily by
     billions of legitimate operators, in every nation, by
     children being taught mathematical concepts... A graphic
     representation of data abstracted from the banks of every
     computer in the human system.  Unthinkable complexity.  Lines
     of light ranged in the nonspace of the mind, clusters and
     constellations of data.  Like city lights, receding..."
     - William Gibson, "Neuromancer"
    
     "640K ought to be enough for anybody." - Bill Gates, 1981
     -------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Fri Apr 27 2001 - 07:58:22 PDT