Digital Forensics / Basic: scope, integrity, and interpretation / Lesson 3

Keep handling and derivation records

Document object identity, actions, handoffs, and transformations without inventing real custody events.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Distinguish an object inventory from a chronological action record.
Describe gaps accurately and preserve the relationship between source and derivatives.

Make the analytical history understandable

Another analyst should be able to identify what material was examined, which copy was used, what changed, and which output supports a conclusion. An object inventory identifies items; an action record explains what happened to them. In real work, custody and handling requirements depend on the approved process and authority. This course records only generation and analysis of invented fixtures. A well-formed classroom table does not establish a real chain of custody or legal admissibility. Avoid adding realistic-looking signatures, people, or collection events that never occurred.

Identify objects independently of their display names

A filename can change, be duplicated, or describe a derivative rather than the source. Give each analytical object a stable local id, type, origin description, and relationship to its input. Include algorithm and digest when appropriate, while remembering the separate provenance limitations. The first record identifies a source fixture and a parsed derivative without asserting real acquisition. It is non-runnable planning data. Keep the inventory minimal enough to review, but do not omit the object boundary that explains whether a reported digest covers a whole fixture, a selected section, or an output table.

json A classroom object relationship inventory

{"exercise":"LAB-HANDLING-02","objects":[{"id":"fixture-a","kind":"author-created-bytes","origin":"classroom-generation"},{"id":"table-a","kind":"parsed-derivative","input":"fixture-a","method":"parser-lab-v1"}],"realAcquisition":false,"realCustodyClaim":false}

The non-runnable record contains no real evidence, person, signature, or acquisition. It identifies a derivation relationship only. Actual handling procedures and their legal consequences are outside this exercise.

Record actions with inputs and outputs

An action note should say what ran, on which input, with which parameters, at what recorded time, and what output resulted. Separate a read-only parse from a transformation that creates new bytes. The program verifies that a tiny synthetic derivation record names an existing input and a distinct output. It does not validate whether a human performed an action or whether timestamps are accurate. A checklist can detect missing fields while the truth and completeness of those fields still require supporting evidence. Treat bookkeeping and actual history as different claims.

python Check a synthetic derivation record

objects = {"fixture-a", "table-a"}
action = {"input":"fixture-a", "output":"table-a", "method":"parser-lab-v1", "purpose":"select-workshop-references"}
assert action["input"] in objects
assert action["output"] in objects
assert action["input"] != action["output"]
assert action["method"] and action["purpose"]
print("derivation record relationships checked")

Expected output

derivation record relationships checked

The complete program checks field relationships in memory and executes no parser. The declared method is a classroom label. A passing result establishes record consistency only, not actual custody, action execution, or source preservation.

Preserve gaps and corrections visibly

If an earlier note omitted a parameter or a handoff time, do not invent a precise value to make the table look complete. Record the gap, source of any later correction, and resulting analytical limitation. Distinguish contemporaneous observations from reconstructed notes. A sequence number can preserve recorded order even when time accuracy is unknown, but it cannot prove real event order beyond the process that generated it. Retain original entries when correcting a record through the approved process. Silent edits make it harder to assess which conclusion relied on which version.

Keep records useful without unnecessary exposure

Handling notes can themselves contain sensitive paths, identifiers, or content excerpts. Include only what the analytical purpose needs, use approved access and retention, and refer to restricted material by a stable identifier rather than copying it everywhere. In the classroom, use public invented markers. A report should explain which objects and steps support its findings and identify unrecorded history honestly. Good documentation helps review and reproducibility, while never substituting a filled form for actual provenance, trustworthy execution, or an accountable authority decision.

Common errors and fixes

A completed form is called proof of custody

Why it happens: Record structure is confused with actual handling history.
How to fix it: State the real observations and identify unverified history.
Prevent it next time: Separate consistency checks from provenance claims.

A derivative reuses the source id

Why it happens: Object relationships become ambiguous.
How to fix it: Assign distinct ids and record the input-method-output link.
Prevent it next time: Keep source and output inventories explicit.

A missing time is filled with a guess

Why it happens: Uncertainty is replaced with fabricated precision.
How to fix it: Record the gap and source of later reconstruction.
Prevent it next time: Preserve original notes and correction history.

Check your understanding

1. A parser output has the same filename as its input. How can the notes remain clear?

Show worked solution

Use distinct stable object ids and record the exact input, transformation, parameters, and output. Keep the source bytes intact and identify which digest covers each object. The filename can remain display metadata; it must not be the sole identity used to explain derivation.

2. An analyst cannot recover the original handoff time. What should the report say?