Evidence handling for screenshots and hash chains in security

// Introduction

Effective evidence handling is crucial in security operations, especially when dealing with digital artifacts. In this blog post, we'll examine what constitutes a defensible screenshot and how to maintain a hash chain to ensure the integrity of digital evidence.

// Defensible Screenshots

Screenshots can serve as immediate evidence in investigations, but they must be captured and stored correctly for them to hold up in court or during an assessment.

Best Practices for Capturing Screenshots

• Use a trusted tool: Rely on built-in OS tools or well-reviewed third-party applications to ensure authenticity.
• Capture metadata: When possible, include additional contextual data such as timestamps and system information.
• Document the capture process: Record details about how and when the screenshot was taken.

#### Example of a Defensible Screenshot Capture Command If you're using a command-line tool for screenshots, consider the following example:

scrot -q 100 -d 2 -o screenshot_%Y-%m-%d_%H:%M:%S.png

This command captures a screenshot with a 100% quality setting after a 2-second delay, appending a timestamp to the filename.

Storing Screenshots Safely

• Use write-once media: Store screenshots on media that is not easily altered, such as DVDs or specialized USB drives designed for evidence.
• Implement access controls: Limit who can access these files to prevent tampering.
• Keep original files intact: Avoid editing screenshots. Instead, create copies for any further analysis.

// Understanding Hash Chains

A hash chain is a sequence of cryptographic hash functions computed from a set of data, usually utilized for maintaining the integrity of files. In the context of evidence handling, hash chains ensure that your evidence has not been altered over time.

Steps to Create a Hash Chain

1. Generate a hash of the original file: Use a secure hashing algorithm like SHA-256 to create a hash of your screenshot or original evidence. 2. Document the hash: Record the resulting hash along with its creation timestamp and relevant metadata. 3. Continue hashing: Each time you access or create a copy of the file, generate a new hash based on the previous hash and the data.

Sample Hash Generation Command

To generate a SHA-256 hash of a file, you can use the following command:

sha256sum your_screenshot.png > your_screenshot.sha256

Hash Chain Storage

• Store hashes securely: Similar to screenshots, hashes should be stored in a write-once format, protected from unauthorized changes.
• Sign the hash documentation: If possible, use digital signatures to confirm the integrity of the recorded hashes.
• Maintain a chain of custody: Keep detailed records of who accessed the original file and the changes made to it.

// Closing

Evidence handling is not just about capturing images or files; it's about ensuring the integrity and reliability of that evidence. By accurately capturing defensible screenshots and maintaining a robust hash chain, you strengthen the validity of your findings.

Remember that the Academy curriculum is free. I encourage you to practice these techniques in a controlled environment or disposable range to refine your skills.