Ravi Sir's Cyber Security Cards › Revision Cards
Core Principles
Core Principles The core rules of handling digital evidence. Never work on the original device. Make a copy (image) first. Prove the copy is unchanged with a hash (a fingerprint). Keep a chain of custody (who held the evidence, when). Working directly on the live disk. That changes the evidence, and
Read card text
What this card says
What it is
The core rules of handling digital evidence.
Key rules
Never work on the original device. Make a copy (image) first.
Prove the copy is unchanged with a hash (a fingerprint). Keep a chain of custody (who held the evidence, when).
Common mistake
Working directly on the live disk. That changes the evidence, and a court can reject it.
Always: image, hash, then analyse the copy.
| Principle | Meaning |
|---|---|
| Preserve the original | Never work on the original device; it must not change |
| Work on a copy (image) | Make a bit-for-bit copy and examine that |
| Prove integrity with hashing | Hash the original and the copy; equal hashes prove nothing… |
| Chain of custody | Document who handled the evidence, when, and why – every… |
| Use a write blocker | Hardware/software that lets you read a disk without writing… |
Learn more in the lesson: 28.2 Core Principles