Chain of Custody

Chain of custody is an evidence-handling discipline, not a storage feature. It establishes where an artifact came from, who or what collected it, when collection occurred, how it was protected, and what happened to it afterward. Relevant artifacts include operating system logs, application logs, cloud API activity, disk snapshots, memory captures, configuration records, and incident-response execution records. A useful custody record includes a case identifier, evidence identifier, source account and resource, collection time in UTC, collection method and tool version, collector identity, storage location, and subsequent access or transfer events.

In cloud environments, the collector may be an automation role rather than a human investigator. Record the role identity, workflow execution identifier, API request identifiers where available, and the actions performed. Preserve both the artifacts and their provenance in a security-controlled account or equivalent administrative boundary. Separate evidence collection permissions from investigation and deletion permissions, and preserve access to the encryption keys required to read retained evidence.

For example, a detection involving an Amazon EC2 instance can initiate an AWS Step Functions workflow that invokes AWS Systems Manager or Lambda functions. The workflow can record instance metadata, collect system and application logs, create Amazon EBS snapshots, and copy exported artifacts into a protected Amazon S3 evidence bucket. Specialized tooling is needed for memory acquisition; an EBS snapshot captures disk state, not RAM. The Automated Forensics Orchestrator for Amazon EC2 is an example of a solution for automating forensic acquisition, but using automation does not itself establish a complete custody record.

Containment and preservation must be coordinated. Terminating an instance, stopping a process, rebooting a host, rotating logs, or rebuilding a workload can destroy evidence. When feasible, collect volatile evidence before disruptive actions and preserve disk evidence before repair. Active harm may require immediate containment instead; document that decision and its evidentiary consequences. Isolation should preserve the communication paths required for approved collection without leaving unnecessary attacker access. Recovery and failover restore availability but do not automatically preserve evidence.

Integrity verification complements custody documentation. Calculate a cryptographic hash, such as SHA-256, for collected files and verify it after transfers and before analysis. Protect the manifest containing those hashes separately from unrestricted investigator access. Do not assume an S3 ETag is always a file's MD5 hash. For managed snapshots, retain snapshot identifiers, source relationships, timestamps, and API audit records; hash exported or acquired disk images when that is part of the forensic procedure. Perform analysis on working copies and preserve the acquired evidence unchanged.

Logs require deliberate collection and retention settings. Preserve relevant system and application logs alongside cloud audit logs, including source identifiers, time zones, collection windows, and known gaps. AWS CloudTrail records supported API activity, not arbitrary operating system activity, and S3 object-level access auditing requires appropriate data-event configuration. CloudTrail log file integrity validation can help detect changes to delivered log files, but investigators must actually perform validation; enabling it is not proof that all evidence is complete or authentic.

Immutability, encryption, and hashing solve different problems. Write-once retention protects against modification or deletion during the configured retention period, encryption controls confidentiality, and hashes detect content changes relative to a trusted reference. None replaces a documented custody history or guarantees legal admissibility. Test response workflows for collection failures, permission errors, duplicate triggers, retention enforcement, and successful evidence retrieval. Balance storage costs, privacy obligations, and retention requirements against investigative needs, and record unavoidable gaps rather than claiming an unbroken history that cannot be demonstrated.