Talk of a «digital chain of custody» and people tend to picture a single procedure, applied uniformly to any situation: clone the disk bit by bit, compute a hash, done. The reality — at least under the reference Spanish standard on the matter — is more nuanced, and that difference matters a great deal when defending an extraction in court.
Two scenarios the standard treats differently
UNE 71506:2013 structures the forensic process into preservation, acquisition, documentation, analysis and presentation. Within the acquisition phase, it explicitly distinguishes two scenarios with different requirements:
- §7.1 — Powered-off systems. The classic scenario: the device is off, bit-by-bit cloning is possible, and the result is perfectly reproducible — anyone can repeat the process and get exactly the same image.
- §7.2 — Live systems («Live Forensics»). The machine is still running: there are active processes, volatile memory, network connections. Bit-by-bit cloning in the same sense isn't possible, because the system itself keeps changing while evidence is being extracted.
What the standard acknowledges about live systems
Here's the nuance that's easy to miss: the standard is explicitly permissive about this second scenario, precisely because it recognizes its different nature. It states outright that these techniques «do not allow for reproducibility», and adds something even more important:
«the validity of the results obtained largely depends on how they are justified in the expert report».
In other words: in a live extraction, what holds up the evidence isn't an identical hash a third party could reproduce — that doesn't exist here in the same way — but the documented procedure. How it was done, when, by whom, and with what guarantees that nothing was altered beyond what's unavoidable from working on a live system in the first place.
The standard even anticipates the most obvious objection — «what if the hash changes because the system is still running?» — and answers that a dynamic hash, typical of a live system, «should not affect its potential legal value», as long as it's justified in the report.
What this means in practice
If your live-acquisition procedure relies solely on «I computed a hash of the file when I finished», you're missing half of what the standard actually values. What does matter, under this same reasoning:
- Recording the full acquisition session, not just the final result.
- Stamping every artifact at the moment — not reconstructing the timing afterwards, from memory.
- Documenting who performed the extraction and with what tool.
- Letting a third party independently verify all of the above, without relying solely on your word.
What the standard doesn't ask you to do (and shouldn't be claimed)
UNE 71506 devotes an entire chapter (§9) to forensic analysis — recovering deleted data, studying the operating system, indexing, analyzing internet artifacts — which is different work from acquisition, and not something a capture tool needs to solve. Its own §1 also clarifies that certifying software isn't its purpose: what could be accredited, if one wanted to go down that road, is the laboratory (ISO/IEC 17025), not the program used.
Any tool — or vendor — claiming «UNE 71506 certification of the software» is promising something the standard itself explicitly says it does not grant.
The practical takeaway
On live systems, a documented procedure outweighs the promise of an immutable hash. Recording, stamping on the spot, and leaving everything independently verifiable isn't a cosmetic extra — under the standard's own framework, it's the part that actually holds up the legal validity of a live extraction.
