Security And Privacy

15.1 Handling Sensitive Evidence

Eviquire evidence may contain:

• Personal data.
• Credentials.
• Cookies.
• Session tokens.
• Mail messages.
• Attachments.
• Network traffic.
• TLS keys.
• Business confidential data.
• Privileged legal material.
• Malware or suspicious downloads.

Treat all Eviquire packages as sensitive unless classified otherwise.

15.2 Encryption Recommendations

Use encryption for:

• Evidence storage volumes.
• Exported ZIP files where supported.
• External drives.
• Backups.
• Long-term archives.
• Transfers.

Encryption should be paired with key management. A lost password may make evidence inaccessible.

15.3 Access Controls

Restrict access according to role:

• Investigators collect evidence.
• Forensic examiners validate packages.
• Legal teams review reports.
• Administrators manage software and licensing.
• Auditors review logs and controls.

Use least privilege and maintain access logs where possible.

15.4 Storage Best Practices

• Store evidence on approved encrypted storage.
• Avoid local desktop folders for long-term storage.
• Use evidence repositories with access logging.
• Back up original packages.
• Maintain immutable or write-protected copies where policy requires.
• Record hashes at transfer and archive points.

15.5 Retention Policies

Retention depends on legal, regulatory, organizational, and case requirements. Define:

• How long original packages are retained.
• Who can authorize deletion.
• How deletion is recorded.
• How backups are handled.
• How sensitive data is minimized.
• How privileged data is segregated.

Warning: Do not delete evidence packages unless authorized by policy, legal hold status, and case disposition.

15.6 Sensitive v6 Artifacts and Sharing

HAR, Chromium NetLog, advanced cookie records, browser profiles, TLS key logs, and system packet captures may include authentication data or information beyond the target page. When exporting an acquisition, apply the organization’s access-control, redaction, secure-sharing, and retention requirements to each of these components.

Case attachments are included in exported cases. The Files tab warns that recipients of the case package can access those files. Do not attach workpapers or privileged communications unless their inclusion in the export is authorized and deliberate.