Chain Of Custody

9.1 What Gets Logged

Eviquire logs events that explain acquisition activity. Events include:

• Session welcome and version.
• Acquisition ID, name, and type.
• Investigator identity.
• Tor and proxy information.
• Start time.
• Video recording state.
• Network traffic state.
• Automatic tests state.
• WHOIS/system/certificate/deep collection state.
• DNS-over-HTTPS settings.
• User navigation.
• Browser page-load events.
• Screenshots.
• Page source saves.
• Downloads.
• Evidence summary saves.
• Evidence archive saves.
• Report saves.
• Timestamp events.
• Recording start and end.
• Session closed.
• Errors or cancellation events.

Each event can include a file and hash when a file is produced.

9.2 UTC Timestamps

Events use UTC timestamps. UTC is important because it avoids ambiguity across time zones, daylight saving changes, and geographically distributed teams. When presenting evidence, explain whether displayed times are UTC or local time. Eviquire chain-of-custody records should be treated as UTC unless otherwise noted.

9.3 Investigator Identity

Investigator identity appears in session metadata, reports, summaries, and chain-of-custody context. Before starting an acquisition, verify that the correct operator identity is configured. For multi-operator investigations, use separate acquisitions or clearly document handoffs.

9.4 URLs And Page Context

For web events, Eviquire records URLs, domain information, page title, and user agent where available. This helps reviewers understand what page was captured and under what browser identity. For split-view captures, Eviquire can record left and right URL/user-agent/page-title context.

9.5 Hashes In Chain Of Custody

When an event creates or references a file, the log can include the file’s SHA2-256 hash. This hash supports later verification. If a reviewer extracts a file and computes SHA2-256, the value should match the recorded value unless the file was altered.

9.6 Reports In Chain Of Custody

Report creation is also logged. This matters because reports are generated artifacts and should be traceable. Evidence PDF and JSON reports, acquisition reports, and case reports are all part of the final deliverable structure.

9.7 How Logs Are Used In Court Or Formal Review

Chain-of-custody logs can help answer common evidentiary questions:

• Who performed the acquisition?
• When did the session start and end?
• What was captured?
• What URL was visited?
• Was the page loaded successfully?
• Was the evidence file hashed?
• Were reports generated?
• Did the session close normally?
• Were there errors?
• Were proxy, Tor, video, network, or DNS settings active?

Logs do not by themselves prove truth of web content. They document the tool’s actions and handling process. They are strongest when combined with reports, hashes, timestamps, source files, screenshots, and investigator notes.

9.8 Best Practices

• Confirm investigator identity before capture.
• Use descriptive acquisition names.
• Keep acquisition comments factual.
• Avoid unrelated browsing during acquisition.
• Do not manually move or rename files inside active acquisition folders.
• Review logs after capture.
• Preserve original packages.
• Export copies for review rather than modifying originals.