Evidence storage and retention

Between collection and the end of a case, evidence spends most of its life in storage. A case can last for years, and the item that comes out of the store must be the same one that went in, still readable and still accounted for. This lesson covers storage for physical items and for digital evidence, the difference between master and working copies, how long evidence is kept, and how it is returned or destroyed at the end. Packaging for transport is covered in Module 3.

Storing physical items

Physical evidence, such as computers, drives, phones and memory cards, is kept in a dedicated, secure area: a locked room, cabinet or safe used only for evidence.

• Access control: only named custodians hold keys or access cards; anyone else is signed in and accompanied.
• Logs: every item entering or leaving is recorded in its custody record, and entry to the store itself is logged, by an electronic access system or a signed register.
• Temperature and humidity: stable, moderate and dry conditions, because heat, damp and condensation damage electronics and media.
• Static electricity: drives, memory cards and circuit boards are kept in antistatic bags.
• Magnetic fields: strong magnets can damage magnetic media such as hard disk drives and tapes, so these are kept away from loudspeakers, motors and other magnetic equipment.
• Physical safety: items are shelved so they cannot fall or be crushed, and damaged or swollen lithium batteries, which are a fire risk, are isolated according to safety guidance.

Items from different cases are not mixed in one container, and the store is organized so that any item can be found quickly from its identifier. The store is also audited: at regular intervals, the custodian or an independent person checks the items on the shelves against the custody records, confirms that seals are intact, and reports any item that is missing, misplaced or unrecorded. Discrepancies are investigated and documented, not quietly corrected.

Storing digital evidence

Forensic images, exports and extracted files need the same care in digital form.

• Encrypted storage, so that a lost drive or a breached server does not expose the data, which often includes personal information about people who are not part of the case (Module 2).
• Access control through individual accounts, granted per case and removed when no longer needed, with access logged.
• A second copy on separate media or in a separate location, verified by hash against the acquisition value, so that a single failure cannot destroy the evidence.
• Periodic integrity checks: hash values are recalculated on a schedule and compared with the acquisition values, and the results are logged.
• Migration when needed: storage media age and file formats fall out of use, so evidence held for years may be moved to new media, with hash verification before and after.

The keys and passwords that protect evidence storage are critical in their own right: if they are lost, the evidence is lost with them. They are managed under the same access rules as the evidence.

Master copies and working copies

A common practice is to keep one master copy of each forensic image that is never examined directly. It is stored read-only, and its hash matches the value recorded at acquisition. Examiners work on working copies made from the master and verified by hash before use. If a working copy is damaged, altered by a tool or simply no longer trusted, a fresh one is made from the master. The original device, where it is retained, stays sealed in the evidence store and is reopened only for a recorded reason, such as the need to acquire it again.

Storage requirements by evidence type

Retention and legal holds

How long evidence is kept is not the examiner's decision. Retention periods are set by law, by contract or by organizational policy, and they vary with the type of case and the jurisdiction. Evidence in serious criminal cases is often kept for many years, because appeals and reviews may follow, while a corporate investigation may follow the organization's records policy. Each item should have its retention period or end date recorded, and nothing is destroyed before it.

A legal hold, also called a litigation hold, overrides normal retention: when legal proceedings are under way or reasonably expected, relevant items and data must be preserved even if their normal retention period has ended. Holds are common in civil litigation and electronic discovery, which ISO/IEC 27050 addresses. Before disposing of anything, the custodian confirms that no hold applies.

Return and disposal

At the end of a case, items are returned to their owner, kept longer, or destroyed. Each outcome needs:

1. Authorization from the person or body entitled to give it, recorded in the case file.
2. A complete list of the item and every copy, including working copies, second copies and exports, so that none is forgotten.
3. Return against a signature, which closes the custody record, or destruction by a method suited to the media, such as overwriting, cryptographic erasure or physical destruction. NIST SP 800-88 describes media sanitization methods.
4. A record of destruction: what was destroyed, how, when, by whom and in whose presence, often issued as a certificate.

Deleting a file from an evidence server is not secure disposal: the data may remain on the media and in backups. Copies held outside the store, on an examiner's workstation or a reviewer's laptop, are the ones most often forgotten. The case file, including the notes, custody records and destruction record, is usually kept after the evidence itself is gone, so that the work can still be reviewed.

Quality frameworks

Storage and handling are part of a laboratory's quality system: ISO/IEC 17025 sets general requirements for the competence of testing and calibration laboratories and is used to accredit many forensic laboratories, while ISO/IEC 27037 includes the preservation of digital evidence among the activities it covers.

Exam focus: Know the storage requirements for physical items (access control, logs, stable temperature and humidity, protection from static and magnetic fields) and for digital evidence (encryption, access control, a verified second copy, periodic hash checks), and the difference between master and working copies. Expect questions on retention set by law, contract or policy, legal holds that override normal deletion, and authorized, documented return or destruction of every copy. Recognize ISO/IEC 17025 as the laboratory competence standard.