RSG #331: How To Reconstruct the Chain of Custody for Missing Digital Evidence
Digital evidence rarely disappears with a theatrical puff of smoke. It is copied, renamed, converted, moved, redacted, separated from attachments, or excluded from a production. By the time the public notices, five offices may possess five versions and everyone has developed a sudden devotion to passive voice. Reconstructing the chain of custody means documenting where …