The Digital Evidence Lifecycle

Digital evidence passes through twelve stages between the moment someone realises a device matters and the day its copies are destroyed. Each stage protects the next, and every weak link is found by the other side.

GuideDFRTI2026CurrentReviewed 2 November 2026

The Twelve Stages

01Identification
Recognising which devices, accounts and data sources might hold relevant evidence, including the ones that are easy to miss such as routers, wearables, cloud accounts and the DVR in the next room. The usual failure is tunnel vision on the obvious phone and laptop. A written list of potential sources, with what each might contain, is what the authority stage needs.
02Authority and Scope
Establishing the legal basis for every action: a warrant, a court order, a summons under section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, a contract or the owner's documented consent, together with the limits that go with it. Examinations that exceed their authority produce evidence that may be excluded and examiners who may be liable. The record of authority, and of what it does not permit, must travel with the evidence.
03Preservation
Stopping change from the moment a source is identified: isolating phones from networks, deciding whether a running system is kept alive, preventing writes and placing legal holds on cloud and corporate data. Powering on a seized SSD to have a look, or letting a phone receive a remote wipe, destroys evidence before anyone has copied it. Preservation delivers an unchanged source to collection.
04Collection
Taking physical or logical possession of the source: seizing the device, photographing it in place, labelling it and starting the custody record with the authority that allowed it. Under the Sanhita the search and seizure may have to be video recorded. Missing labels and unsigned seizure lists are the common failure. Collection hands acquisition an identified exhibit with a custody record already open.
05Acquisition
Making the forensic copy: a bit-stream image through a write blocker or duplicator, a logical or file-system extraction from a phone, a memory capture or an export from a cloud provider, with hashes computed as the data is read and verified afterwards. Imaging without verification, or without recording the tool, version and times, leaves nothing to prove later. Acquisition delivers a verified copy and the original untouched.
06Examination
Processing the copy to find and extract the data that may matter: parsing file systems, recovering deleted material, decoding application databases, carving unallocated space and filtering with known-file hash sets. Working on the master copy instead of a verified working copy is the classic error. Examination delivers extracted artefacts with their locations and the method used.
07Analysis
Working out what the artefacts mean in the context of the questions asked: building timelines, correlating sources, testing alternative explanations and separating what the data shows from what the examiner infers. Overreach, stating as fact what is only consistent with the data, is what gets reports attacked. Analysis delivers findings with their basis and their limits.
08Documentation
The contemporaneous notes, logs, screenshots and tool outputs that record what was done, when, by whom and with what result, from the first phone call to the last export. Notes written up a week later from memory are not contemporaneous. Documentation is what makes the work repeatable and is the source for the report.
09Reporting
Writing the findings so that a reader with no technical background can follow what was examined, how, what was found and what it means, with the hashes, exhibit references and limitations in place. Reports that bury the answer in tool output, or omit what could not be determined, fail the reader. The report delivers a document that can be read without the examiner present.
10Presentation
Giving evidence: in court, before a tribunal, to a board or to a client, increasingly over video under section 530 of the Sanhita. The examiner must explain, not advocate, and must be able to reproduce any figure in the report from the documentation. Being unable to say how a hash was computed is the failure that undoes everything before it. Presentation delivers testimony that matches the record.
11Retention
Keeping the original evidence, images, working copies, notes and reports for as long as the matter and any appeal, the client's instructions, the laboratory's policy and the law require, under the same access control and custody as during the case. Data protection law now adds retention periods and erasure duties of its own. Retention delivers an intact record for as long as it is needed and a date on which it stops being needed.
12Secure Disposal
Destroying or sanitising every copy when retention ends, with a documented method appropriate to the media, a verification step and a certificate of sanitisation kept with the case file. Returning a client's drive with another client's image still on it, or discarding a working copy unwiped, is a breach waiting to be found. Disposal closes the loop and leaves a record that the data is gone.

A digital forensic result is only as strong as the weakest handling it received. A perfect analysis of an image that was taken without authority, whose hash was never recorded or whose custody has a gap of three days, will not survive cross-examination. This guide sets out the lifecycle DFRTI teaches across its courses: twelve stages, each with a purpose, a typical failure and the thing it must deliver to the stage after it.

The stages are a teaching model, not a standard. They line up with the four processes of ISO/IEC 27037:2012, the four phases of NIST SP 800-86 and the process classes of ISO/IEC 27043:2015, and the mapping is given at the end. A laboratory may merge or rename stages; what it may not do is skip the record that each one leaves behind.

Chain of Custody

Chain of custody is the continuous, documented record of who had each item of evidence, where, when and why, from collection to disposal. It exists so that a court can be satisfied that the thing examined is the thing seized and that nobody could have altered it unnoticed. It is kept per exhibit, it starts at the scene and every transfer gets a line: date, time, from, to, purpose, condition and signatures.

A chain is broken by gaps, not only by tampering. An exhibit that sat unlogged in a desk drawer over a weekend has a gap even if nothing happened to it. The remedy is procedure: a sealed evidence store with controlled access, tamper-evident bags, a log that cannot be edited after the event and the habit of recording movements at once. The Bharatiya Sakshya Adhiniyam, 2023 rewards this directly, because Explanation 5 to section 57 treats a digital record produced from proper custody as primary evidence unless disputed.

One record per exhibit, opened at collection
Every transfer logged with both signatures
Sealed storage with access that is itself logged
Hashes recorded at every handover, not only at acquisition

Integrity, Repeatability and Validation

Hashing and Verification
A cryptographic hash such as SHA-256 is computed on the source as it is read and on the copy afterwards. Matching values show the copy is bit-for-bit the same. The hash protects data only from the moment it is computed and only if the value is kept safely, so hash at acquisition, verify at every transfer and before analysis, and write the algorithm and the full value in the custody record and the report. The Schedule to the Bharatiya Sakshya Adhiniyam, 2023 asks for exactly this.
Evidence Integrity
Integrity means the evidence has not changed since collection. Write blockers, verified images, working copies and sealed storage protect it. Where change is unavoidable, such as live acquisition of a running system or a phone that must be powered on, the examiner records what was done and why and explains the effect, rather than pretending the source was untouched.
Repeatability and Reproducibility
Repeatability means the same examiner, with the same tools and the same data, gets the same result. Reproducibility means a different examiner, in a different laboratory, with their own tools, can reach the same result from the same data. Both depend on documentation and on keeping the verified image. A finding that cannot be reproduced is an opinion, not evidence.
Tool Validation
A tool is validated when the laboratory has tested that it does what it claims on known data before relying on it on case data, and has recorded the version, the test set and the results. Vendor claims are not validation. ISO/IEC 27041:2015 is the standard on assuring that investigative methods are suitable and adequate, and NIST's Computer Forensic Tool Testing programme publishes test methods and results that laboratories can use.
Quality Assurance
Written procedures, trained and assessed examiners, peer review of reports, proficiency testing, equipment records and a way of handling nonconformities. Laboratories that seek accreditation do so against ISO/IEC 17025 with digital forensics in scope. Quality assurance is what turns one examiner's good habits into a laboratory's reliable output.
Limits Stated
Every stage has things it cannot show. An SSD image may not contain deleted data; a logical phone extraction omits what the operating system withholds; a timestamp is only as good as the clock that set it. Stating the limits is part of integrity, and a report that states them is harder to attack than one that claims too much.

How the Standards Map onto the Stages

The standards below are guidelines. Following them does not make anyone compliant with any law or accredited by anyone; it makes the work defensible and recognisable to other practitioners.

Indian Law: The Bharatiya Nagarik Suraksha Sanhita, 2023 governs authority, collection and the recording of searches; the Bharatiya Sakshya Adhiniyam, 2023 governs how the result is admitted and what the certificate must contain; the Digital Personal Data Protection Act, 2023 and its Rules add security, retention and erasure duties to the retention and disposal stages.
ISO/IEC 27037:2012: Guidelines for identification, collection, acquisition and preservation of digital evidence. It covers the first five stages here, defines the roles of digital evidence first responder and digital evidence specialist, and sets the principles of relevance, reliability and sufficiency. Published 2012, reviewed and confirmed by ISO in 2018.
ISO/IEC 27041:2015: Guidance on assuring suitability and adequacy of incident investigative method. It underpins tool validation and quality assurance across every stage, asking the laboratory to show that its methods meet defined requirements. Confirmed by ISO in 2021.
ISO/IEC 27042:2015: Guidelines for the analysis and interpretation of digital evidence. It covers examination, analysis, documentation and reporting, including the competence of the examiner and the difference between what the data shows and what the examiner interprets. Confirmed by ISO in 2021.
ISO/IEC 27043:2015: Incident investigation principles and processes. It is the umbrella model: readiness processes before an incident, initialisation, acquisitive and investigative processes during one, and concurrent processes such as authorisation, documentation, preserving the chain of custody and preserving evidence that run through all of them. The twelve stages are a simplified reading of it. Confirmed by ISO in 2020.

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, published by NIST in August 2006 and still current. Its four phases of collection, examination, analysis and reporting map onto stages four to nine here, and its advice on data sources, on maintaining integrity and on organisational policy remains the plainest introduction to the subject.

Common Questions

Is the lifecycle the same for a corporate investigation and a criminal case?

The stages are the same. What differs is the source of authority, the standard of proof and who the audience is. A corporate matter may rest on an employment contract and end with a board report; a criminal matter rests on the Sanhita and ends in court. Treat every corporate matter as if it might become a criminal one, because some do.

Which stage do laboratories most often get wrong?

Documentation, because it is tedious and nobody notices until a year later. The second is authority and scope, because examiners assume the client's permission covers everything the client's device contains. The third is disposal, because closed cases are forgotten.

Does following ISO/IEC 27037:2012 make our evidence admissible?

No. Admissibility is decided by the court under the Bharatiya Sakshya Adhiniyam, 2023. Following the guideline makes it far easier to show the court that the evidence was identified, collected, acquired and preserved in a way other practitioners recognise as sound.

How long should hashes and custody records be kept?

As long as the evidence they describe, and in practice longer, because the record is small and the question of what happened to an exhibit can arise after the exhibit itself is lawfully destroyed. Keep the disposal certificate with them.

Official sources

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Disciplines where this applies

Courses that teach it

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.

Explore the Academy About membership Talk to a counsellor