O que é cadeia de custódia digital?

Cadeia de custódia digital é o conjunto de procedimentos documentados que registra cada etapa de manuseio de uma evidência eletrônica — desde sua identificação até o descarte —, garantindo que nenhuma alteração não autorizada ocorreu. No Brasil, o conceito está positivado nos arts. 158-A a 158-F do CPP, incluídos pela Lei 13.964/2019 (Pacote Anticrime).

Por que a cadeia de custódia é obrigatória no processo penal brasileiro?

O art. 158-A do CPP define que a cadeia de custódia é condição para a rastreabilidade dos meios de obtenção da prova. Sem ela, a defesa pode arguir nulidade da evidência por violação ao contraditório e à ampla defesa, tornando a prova inadmissível — independentemente de seu conteúdo incriminatório.

Como o hashing SHA-256 protege a integridade de uma evidência digital?

O algoritmo SHA-256 gera uma impressão digital de 256 bits única para qualquer arquivo ou imagem forense. Se um único bit for modificado, o hash muda completamente. Peritos documentam o hash no laudo antes e depois de cada manipulação; hashes idênticos provam que a evidência não foi alterada entre as etapas da cadeia.

O que é um write-blocker e quando é necessário?

Write-blocker é um dispositivo de hardware ou software que intercepta comandos de escrita entre o sistema do perito e a mídia original, permitindo leitura sem risco de gravar dados (inclusive timestamps do sistema operacional). Seu uso é mandatório na coleta de discos rígidos, SSDs e pen drives sempre que a evidência original precisa ser preservada em estado bit a bit.

Quais erros mais comuns invalidam a prova digital no Brasil?

Os erros mais frequentes são: (1) coleta direta no sistema original ligado sem write-blocker, alterando metadados; (2) ausência de hash no momento da coleta; (3) lacuna documental entre etapas — quem recebeu, onde ficou, por quanto tempo; (4) acondicionamento inadequado (bolsas antiestáticas ausentes, exposição a campos magnéticos); (5) quebra do sigilo da cadeia por acesso não registrado; (6) descarte sem autorização judicial.

Quais normas internacionais orientam a cadeia de custódia de evidências digitais?

A ISO/IEC 27037:2012 define diretrizes para identificação, coleta, aquisição e preservação de evidências digitais. O NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) estabelece boas práticas técnicas de aquisição e análise. Ambas são referenciadas em laudos periciais como parâmetro de conformidade, complementando os requisitos do CPP.

Digital Chain of Custody | Decripte Security

Preservation of digital evidence, chain of custody, legal forensic procedures and admissibility of evidence in investigations and judicial proceedings.

Digital Chain of Custody

The chain of custody is the documented process that records the sequence of control, transfer, analysis and disposition of digital evidence. It is essential to guarantee legal admissibility and integrity of evidence in investigations and judicial proceedings.

Legal Importance of the Chain of Custody

For digital evidence to be admissible in judicial proceedings, it is necessary to demonstrate that it was collected, preserved and analyzed with integrity, without tampering or contamination.

A break in the chain of custody can result in the exclusion of evidence, compromising criminal investigations or civil actions. In a corporate context, poorly preserved evidence can derail actions against malicious employees or limit damage recovery.

Fundamental Principles

Order of Volatility: Collect evidence in decreasing order of volatility - memory records first, then logs, disks, backups, physical documentation.

Non-Alteration: Original evidence must not be altered. Always work on bit-by-bit forensic copies verified by hash.

Complete Documentation: Every action must be documented: who collected it, when, where, how, tools used, hashes calculated.

Traceability: Maintain a record of every person who had access to the evidence, including custody, analysis and transfers.

Stages of the Chain of Custody

1. Identification: Locate and document potential sources of evidence. Photograph and record the initial state before any handling.

2. Collection: Acquire evidence using appropriate forensic methods. For disks, create bit-by-bit images using write blockers. For memory, capture a complete dump.

3. Hash/Integrity: Calculate cryptographic hashes (MD5, SHA-256) of original evidence and copies for integrity verification.

4. Preservation: Store original evidence in a secure, sealed location, with physical and environmental access control (temperature, humidity).

5. Analysis: Work exclusively on verified copies, never on originals. Document all analyses performed.

6. Presentation: Prepare a forensic report detailing methodology, findings and conclusions, with the chain of custody attached.

7. Return/Disposal: After the case concludes, return evidence to the owner or dispose of it securely in accordance with retention policies.

Chain of Custody Form

Each piece of evidence must have its own form containing:

Evidence Identification: Unique control number, detailed description (make, model, serial number), collection location.

Initial Collection: Name of the collector, date/time, witnesses present, condition of the evidence, tools used.

Hashes: MD5, SHA-256 of the original evidence and of each copy created.

Transfer Record: Table with each transfer including: name of who delivered it, name of who received it, date/time, purpose, signatures.

Storage Location: Where the evidence is physically kept, seal/tag number.

Analyses Performed: Log of each analysis: analyst, date, tools, summarized findings.

Digital Evidence Collection

Disks and Storage Media: Use write blockers to prevent accidental writing. Create forensic images with tools such as dd, FTK Imager, EnCase. Calculate and document hashes.

RAM Memory: Capture before shutting down the system, as it is volatile. Tools: LiME, DumpIt, FTK Imager (memory dump).

System Logs: Collect centralized (SIEM) and local logs. Export in native format and also plain text for analysis.

Network Evidence: Packet captures (PCAPs), firewall/proxy logs, dumps of active connections.

Cloud and SaaS: Use provider APIs and tools for data export, respecting chain of custody. Document collection limitations.

Mobile Devices: Specialized tools such as Cellebrite, Oxygen Forensics. Airplane mode to prevent remote alterations.

Forensic Tools

Acquisition: FTK Imager, dd/dcfldd, Guymager, Magnet ACQUIRE.

Analysis: Autopsy, Sleuth Kit, EnCase, X-Ways Forensics, Volatility (memory).

Hash/Verification: md5sum, sha256sum, HashMyFiles, verification built into forensic tools.

Timeline: log2timeline/Plaso for creating detailed forensic timelines.

Mobile: Cellebrite UFED, Oxygen Forensics, XRY, Andriller.

Integrity Verification

Cryptographic hashes are essential to prove that evidence has not been altered:

MD5: Legacy algorithm, still used but no longer recommended as the sole hash due to theoretical collisions.

SHA-256/SHA-512: Recommended for new cases, resistant to collisions.

Re-hashing: Periodically recalculate hashes of preserved evidence to detect media degradation or corruption.

Write Once Media: For long-term preservation, consider WORM media (Write Once Read Many).

Physical Preservation

Packaging: Seal evidence in anti-static bags with identification labels. Photograph before and after sealing.

Controlled Environment: Store in a room with temperature, humidity and restricted-access control. Ideally a safe or vault room.

Logged Access: Physical access control system recording who accesses the evidence storage area and when.

Evidence Backup: Create multiple verified copies and store them in separate locations for redundancy.

Analysis Documentation

Every step of the forensic analysis must be documented:

Methodology: Describe the approach and techniques used, referencing recognized frameworks (NIST, ISO 27037).

Tools and Versions: List all tools with the exact versions used in the analysis.

Commands Executed: For CLI analyses, record the exact commands and relevant outputs.

Findings: Document evidence found with screenshots, log extracts, references to specific files.

Timeline: Reconstruct the chronology of events based on digital artifacts (file timestamps, logs, etc).

Forensic Report

The final report must be complete and understandable for laypersons:

Executive Summary: Executive summary with main findings for non-technical readers.

Chain of Custody: Attach complete chain of custody forms.

Detailed Methodology: Technical section explaining how the analysis was conducted.

Evidence and Findings: Detailed presentation of each piece of evidence with analysis and interpretation.

Conclusions: Technical conclusions based on the evidence, avoiding speculation beyond what the data supports.

Appendices: Complete logs, screenshots, hashes, tables of analyzed files.

Specific Challenges

Encryption: Encrypted evidence requires obtaining keys or passwords. Document decryption attempts and limitations.

Anti-Forensics: Adversaries may use anti-forensic techniques (wiping, timestomp, steganography). Document signs of anti-forensics.

Cloud: Jurisdiction, provider dependency, data in multiple regions. Document collection limitations.

IoT: IoT devices with limited storage and proprietary protocols present unique acquisition challenges.

Legal Aspects in Brazil

Code of Criminal Procedure: Articles 158-184 address forensic examination. Article 159 determines that the examination of the corpus delicti be performed by official experts.

Brazilian Civil Rights Framework for the Internet: Law 12.965/2014, Articles 10-11 address the retention of logs and requirements for breaking confidentiality.

LGPD: Law 13.709/2018 impacts the collection and processing of personal data during investigations. Legitimate interest and compliance with a legal obligation are applicable bases.

Carolina Dieckmann Law: Law 12.737/2012 criminalizes the intrusion of devices and is frequently the basis for forensic investigations.

Certifications and Training

Professionals who handle digital evidence should seek recognized qualification:

International: GCFE (GIAC Certified Forensic Examiner), EnCE (EnCase Certified Examiner), CHFI (Computer Hacking Forensic Investigator), CCFP (Certified Cyber Forensics Professional).

National: Certifications offered by official experts and Brazilian institutions of criminal forensics.

Staying up to date with the evolution of technologies, anti-forensic techniques and legal changes is essential.

Automation and Management

LIMS (Laboratory Information Management Systems): Software for managing evidence, cases and chain of custody in organizations with significant volume.

RFID/Barcodes: Tags for automated tracking of evidence movement.

Digital Signatures: Digital signature on chain of custody documents for non-repudiation.

Final Recommendations

A proper chain of custody is the difference between admissible evidence and compromised investigations. Organizations must establish clear procedures, train responsible teams and invest in appropriate tools. In cases of potential litigation or crime, involving qualified experts from the outset ensures that digital evidence is preserved correctly and can be used effectively in judicial proceedings or internal investigations.