Continuity Witness
Definition
The person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must be logged with date, time, persons involved, and the item's condition or hash state at the time of transfer.
Related terms
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Proprietary DVR Format
- Video storage format used by commercial CCTV/DVR systems that is specific to the manufacturer, often unplayable without the vendor's own software. The...
- Versioning Convention
- A systematic file-naming or directory structure that identifies which version of a processed file is current, preserves earlier processing stages, and prevents...
- Working Copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
Explained in
- Chain of Custody for Media EvidenceThe person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must be logged with date, time, perso...