Build a Digital Evidence Manifest for a Practice Case

A folder containing disk.img and notes.txt is not a complete evidence record. A manifest connects artifacts to identifiers, acquisition details and integrity measurements so another analyst can understand what was collected. Start with a synthetic practice case and keep observations distinct from conclusions.

Assign an identifier before analysis

Use a case identifier and a unique artifact identifier. A filename is useful but can change, so do not rely on it as the only identity. Record the source description, who collected it, when it was acquired and the time zone used. For real investigations, follow the applicable organizational procedure.

Case ID: TRAINING-001
Artifact ID: EVID-001
Description: Synthetic practice disk image
Original filename: practice-disk.img
Acquired by: [collector]
Acquired at: [ISO 8601 timestamp with offset]
Acquisition tool/version: [tool and version]
SHA-256: [measured 64-character digest]
Master location: [protected storage reference]
Working copy: [analysis copy reference]
Read errors or limitations: [observed issues, or none observed]

Separate the manifest from custody events

The manifest describes the artifact. A custody log records transfers, access or handling events according to the procedure: timestamp, person, action, reason and destination. Keeping these concepts separate makes it easier to update the log without rewriting the basic identity of the evidence.

Record how the hash was obtained

A digest without an algorithm or a clear target is ambiguous. State whether you hashed the raw image, a container file or exported content. Include tool versions and any acquisition errors. A matching hash is an integrity observation, not proof of authenticity, completeness or proper handling before collection.

Keep master and working copy roles explicit

Preserve the master according to your process and analyze a separate working copy. Store outputs in a dedicated location rather than mixing generated reports with source artifacts. When you export a derived artifact, assign a new identifier and record which source and transformation produced it.

Use a reviewable format

A spreadsheet or CSV can be sufficient for a practice case if fields are consistent and changes are tracked. Avoid filling unknown values with guesses. Use explicit unknown or not recorded markers and explain their implications. A professional evidence system may require stronger access controls, auditing and retention rules.

Practice and check your understanding

Create two synthetic files, calculate their SHA-256 hashes and fill in the template. Make a working copy of one file, add an analysis note and record the relationship. Ask another learner to locate the correct source using only your manifest.

Continue learning

Explore the related Code Hacker course syllabus for structured learning. Then read Hash Large Files in Python with Streaming SHA-256 to connect this exercise to the next skill.

Reference

NIST SP 800-86 provides the underlying API or technical guidance. Check the documentation for the version you use; examples here are small learning exercises rather than complete production implementations.