NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Evidence Handling & Chain of Custody
Master the legal and technical rigor of digital forensics. Learn to preserve evidence integrity, manage the chain of custody, and avoid catastrophic spoliation.
Room tasks
1Why Evidence Integrity Matters
2Chain of Custody Explained
3Volatile vs Non-Volatile Evidence
4Common Evidence-Handling Mistakes
5Timeline Reconstruction
Frequently Asked Questions
What is chain of custody?
Chain of custody is the documented record of who handled evidence, when, and why, from collection to court. An unbroken record shows the evidence has not been altered.
Why use hashes in forensics?
A cryptographic hash, such as SHA-256, acts as a fingerprint for a disk image or file. Matching hashes before and after handling prove the data has not changed.
What is evidence spoliation?
Spoliation is the destruction, alteration, or failure to preserve evidence relevant to a case. It can lead to legal penalties. This free Codelivly room teaches how to avoid it.