GUIDE · EVIDENCE
Chain of custody for a file handed over offline
The weakest link in a chain of custody is often the handover itself: a file copied from one machine to another, recorded afterwards on a form by the person who handed it over. The form says what that person remembers. It does not show that the receiver got exactly those bytes.
Written by Taha Bayar, a biologist working on data handover between isolated systems.
A record made at the moment of transfer
- The sending device signs a dispatch record: the file's SHA-256 and size, the case or exhibit reference, the classification and the operator's declared name or ID.
- The receiving device checks the file against it and signs a delivery receipt that contains the dispatch record.
- Optionally, the receipt gets an RFC 3161 timestamp from DigiCert, so it provably existed at that time and not only by the devices' own clocks. Only the receipt's fingerprint is sent for this, never the file.
- A local audit chain links each receipt to the previous one on that device, so a removed or inserted entry shows.
The handover itself needs no network: screen to camera, printed pages or a one-way serial cable. Verification needs none either; a free, Apache-2.0 verifier checks the records without Kionel.
When only the proof should leave
Sometimes the file must stay where it is and only evidence of it should leave. Sealing makes a signed record of the file's SHA-256, time, reference and operator on the isolated machine and shows it as one code, which can also be printed on paper. Anyone can later check a copy of the file against it.
What the records do not prove
- Keys, not people. A signature shows which device key signed. Tying a key to a person is your organisation's identity process; the operator field is what the person typed.
- Device clocks can be set back. Without a trusted timestamp, the times are what the two devices said.
- Nothing about how the file was collected. The records start at the handover; acquisition and imaging have their own standards, such as ISO/IEC 27037.
- Admissibility is a legal question for your jurisdiction, not something a tool can promise.