Continuity witness
Definition
The person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must be logged with date, time, persons involved, and the item's condition or hash state at the time of transfer.
Related terms
- Hash value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Proprietary DVR format
- Video storage format used by commercial CCTV/DVR systems that is specific to the manufacturer, often unplayable without the vendor's own software. The...
- Versioning convention
- A systematic file-naming or directory structure that identifies which version of a processed file is current, preserves earlier processing stages, and prevents...
- Working copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write-blocker
- A hardware or software device that prevents any write operations to a storage device during forensic imaging. It ensures the image process...
Explained in
- Chain of Custody for Media EvidenceThe person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must be logged with date, time, perso...