The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

Evidence handling: what a defensible screenshot and hash chain looks like

2024.04.02//6 MIN READevidenceforensicshashingscreenshot

// Introduction

In digital forensics, the integrity and defensibility of your evidence collection process is paramount. This involves not only capturing evidence, like screenshots, but also ensuring that you can prove that evidence has not been tampered with throughout your investigation. In this post, we will cover the characteristics of a defensible screenshot and the proper management of a hash chain.

// The Importance of a Defensible Screenshot

A screenshot can serve as critical evidence in many scenarios, such as phishing investigations or unauthorized access cases. However, to be considered defensible, there are specific steps to follow:

Characteristics of a Defensible Screenshot

  • Full Context: Capture the entire context of the screen, including the active window and parts of the surrounding interface.
  • Date and Time Stamp: Ensure that the screenshot displays the date and time to establish a timeline.
  • Original State: The screenshot should be taken directly from the live environment without alterations.
  • No Manipulation: Avoid any manipulation or edits to the screenshot, which could compromise its integrity.

Tools and Techniques for Capturing Screenshots

Use reliable tools to capture screenshots. Here are some commonly used tools with various capabilities:

  • Built-In Snipping Tools: Use native operating system tools (e.g., Snipping Tool on Windows, Grab on macOS).
  • Command Line Tools: Leverage command-line utilities for more advanced scenarios.

Example using scrot on Linux:

scrot -s -o -q 100 screenshot.png

In this command:

  • -s allows you to select the area to capture.
  • -o overwrites any existing file with the same name.
  • -q 100 sets the quality of the image to 100%.

// Managing Hash Chains for Evidence Integrity

Once you’ve collected evidence, managing its integrity becomes crucial. A hash chain is a method to track the state of your evidence files throughout the investigation. The chain of hashes allows you to prove that you have maintained the original integrity of your evidence.

Creating a Hash Chain

The hash chain involves generating a cryptographic hash of the file at each stage of the evidence handling process. Follow these steps:

1. Initial Hashing: After capturing the evidence, generate a hash of the original file. 2. Log Information: Record the hash along with relevant metadata, such as the date, time, and any notes on the capture process. 3. Chain the Next Hash: Any time the evidence file is modified, re-hash it and link the new hash to the previous one. This creates a verifiable chain.

Hashing Tools

Commonly used hashing tools include:

  • MD5: Generally considered fast but less secure due to vulnerabilities.
  • SHA-1: Still used, but also shows weaknesses over time.
  • SHA-256: Part of the SHA-2 family, it is currently one of the best options for integrity checks.

#### Example of Hash Generation Here’s a command to hash a screenshot using SHA-256:

sha256sum screenshot.png > screenshot.hash

In this command:

  • sha256sum calculates the SHA-256 hash.
  • The output is redirected to a file called screenshot.hash, which you will want to reference as you maintain the chain.

// Documenting Your Evidence Workflow

Maintaining comprehensive documentation is essential. Create a log file to track every action taken with the evidence. Include the following details:

  • Timestamp of each action
  • Description of the action (e.g., capture, hash generation)
  • The individual responsible for the action

Example Log Entry

2023-10-10 14:35:20 - Captured screenshot of suspicious email - User: john_doe
2023-10-10 14:36:01 - Generated SHA-256 hash for screenshot.png - User: john_doe

// Conclusion

Proper evidence handling involves meticulous practices to ensure that your findings remain defensible in various scenarios. By understanding how to capture defensible screenshots and consistently manage a hash chain, you ensure the integrity of your evidence throughout any investigation.

The DaemonCore Academy curriculum is free, and we encourage you to practice these techniques in a disposable environment. Familiarize yourself with these processes to enhance your proficiency and readiness for real-world applications.