Method and apparatus for controlling digital evidence

1. A computer-implemented method of authenticating digital evidence and establishing a chain of custody of the digital evidence, comprising:

operating a computer-implemented digital evidence control system that allows access to digital evidence stored in a plurality of hosts without interfering with authenticity of the digital evidence and that provides a process for maintaining a chain of custody of the digital evidence;

establishing and maintaining authenticity of at least one piece of digital evidence due to the digital evidence control system allowing access to the at least one piece of digital evidence without interfering with the authenticity of the at least one piece of digital evidence; and

establishing and maintaining a chain of custody of the at least one piece of digital evidence due to the digital evidence control system providing a process for maintaining the chain of custody of the at least one piece of digital evidence;

the computer-implemented method comprising creating, on a computer executing the digital evidence control system, a case record comprising information about an investigative case, generating, using the computer, a cryptographic hash of the at least one piece of digital evidence, by creating a clone of the at least one piece of digital evidence and generating, using the computer, a cryptographic hash of the clone, and associating the cryptographic hash with the case record so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the digital evidence, and creating a chain of custody within the case record using a chain of custody interface screen of the digital evidence control system, the chain of custody including identification of entities that have interacted with the at least one piece of digital evidence;

the computer-implemented method further comprising displaying

a case information interface screen displaying the information from the case record about the investigative case,

a host information interface screen having a host information window and an evidence list window, the host information window identifying one of the plurality of hosts, on which the at least one piece of digital evidence is stored, the evidence list window identifying items of digital evidence stored on the host including the at least one piece of digital evidence,

an evidence information interface screen having an evidence information window identifying the at least one piece of digital evidence and a clone information window listing the clone created from the at least one piece of digital evidence and identifying a storage location of the clone and identifying the cryptographic hash of the clone to thereby associate the cryptographic hash with the case record so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the digital evidence, and

the chain of custody interface screen, the chain of custody interface screen identifying the at least one piece of digital evidence and the host on which the at least one piece of digital evidence is stored and the identification of the entities that have interacted with the at least one piece of digital evidence,

wherein, upon an entity accessing and interacting with the piece of digital evidence, the chain of custody interfaces screen identifies the entity, and the cryptographic hash displayed in the clone information window of the evidence information interface screen is altered if the entity has tampered with the piece of digital evidence but remains unaltered if the entity has not tampered with the piece of digital evidence.

2. The method of claim 1 wherein the cryptographic hash of the clone is an MD5 hash.

3. The method of claim 1 wherein the case record is created in a relational database.

4. The method of claim 1 further comprising creating an image of the at least one piece of digital evidence.

5. The method of claim 1 further comprising establishing roles for each person in a plurality of persons that are able to access the case record, where each role defines a level of access.

6. The method of claim 1 further comprising creating a unique identifier for the at least one piece of digital evidence.

7. The method of claim 1 further comprising uploading photographic evidence to the case record.

8. The method of claim 1 further comprising creating a timeline within the case record comprising a sequence of events that occurred during an investigation involving the at least one piece of digital evidence.

9. The method of claim 1 wherein the step of creating a chain of custody within the case record comprises identification of persons that have accessed the case record.

10. The method of claim 1 further comprising storing cost information in the case record using a cost involved interface screen of the digital evidence control system.

11. The method of claim 1 further comprising selectably creating at least one report regarding the case record.

12. Apparatus for authenticating digital evidence and establishing a chain of custody of the digital evidence, comprising:

a computer executing a digital evidence control system that allows access to digital evidence stored in a plurality of hosts without interfering with authenticity of the digital evidence and that provides a process for maintaining a chain of custody of the digital evidence, to enable establishing and maintaining of the authenticity of at least one piece of digital evidence, and to enable establishing and maintaining of the chain of custody of the at least one piece of digital evidence;

a memory, coupled to the computer, for storing within a database a case record, established by the digital evidence control system, comprising information about an investigative case; and

at least one client workstation, coupled to the computer, for allowing access to the at least one piece of digital evidence without interfering with authenticity of the digital evidence,

wherein the case record comprises case information entered using an evidence information interface screen of the digital evidence control system, a chain of custody entered using a chain of custody interface of the digital evidence control system, the chain of custody including identification of entities that have interacted with the at least one piece of digital evidence, and a cryptographic hash of the at least one piece of digital evidence, generated by creating a clone of the at least one piece of digital evidence and generating, using the computer, the cryptographic hash of the clone, so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the at least one piece of digital evidence;

the digital evidence control system being programmed to display

a case information interface screen displaying the information from the case record about the investigative case,

a host information interface screen having a host information window and an evidence list window, the host information window identifying one of the plurality of hosts, on which the at least one piece of digital evidence is stored, the evidence list window identifying items of digital evidence stored on the host including the at least one piece of digital evidence,

an evidence information interface screen having an evidence information window identifying the at least one piece of digital evidence and a clone information window listing the clone created from the at least one piece of digital evidence and identifying a storage location of the clone and identifying the cryptographic hash of the clone to thereby associate the cryptographic hash with the case record so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the digital evidence, and

a chain of custody interface screen identifying the at least one piece of digital evidence and the host on which the at least one piece of digital evidence is stored and the identification of the entities that have interacted with the at least one piece of digital evidence,

wherein, upon an entity accessing and interacting with the piece of digital evidence, the chain of custody interfaces screen identifies the entity, and the cryptographic hash displayed in the clone information window of the evidence information interface screen is altered if the entity has tampered with the piece of digital evidence but remains unaltered if the entity has not tampered with the piece of digital evidence.

13. A non-transitory computer readable medium comprising software that, when executed by a processor, causes the processor to execute a digital evidence control system for allowing access to digital evidence stored in a plurality of hosts without interfering with authenticity of the digital evidence, while providing a process for maintaining a chain of custody of the digital evidence, the digital evidence control system performing a method comprising:

creating a case record comprising information about an investigative case using a digital evidence control system;

generating a cryptographic hash of at least one piece of digital evidence, by creating a clone of the at least one piece of digital evidence and generating, using the computer, a cryptographic hash of the clone, and associating the cryptographic hash with the case record so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the at least one piece of digital evidence, so as to enable establishing and maintaining of the authenticity of the at least one piece of digital evidence; and

creating a chain of custody within the case record using a chain of custody interface screen of the digital evidence control system, the chain of custody including identification of entities that have interacted with the at least one piece of digital evidence, so as to enable establishing and maintaining of the chain of custody of the at least one piece of digital evidence;

the digital evidence control system being programmed to display

a case information interface screen displaying the information from the case record about the investigative case,

a host information interface screen having a host information window and an evidence list window, the host information window identifying one of the plurality of hosts, on which the at least one piece of digital evidence is stored, the evidence list window identifying items of digital evidence stored on the host including the at least one piece of digital evidence,

an evidence information interface screen having an evidence information window identifying the at least one piece of digital evidence and a clone information window listing the clone created from the at least one piece of digital evidence and identifying a storage location of the clone and identifying the cryptographic hash of the clone to thereby associate the cryptographic hash with the case record so that the at least one piece of digital evidence can be accessed without interfering with authenticity of the digital evidence, and

a chain of custody interface screen identifying the at least one piece of digital evidence and the host on which the at least one piece of digital evidence is stored and the identification of the entities that have interacted with the at least one piece of digital evidence,

wherein, upon an entity accessing and interacting with the piece of digital evidence, the chain of custody interfaces screen identifies the entity, and the cryptographic hash displayed in the clone information window of the evidence information interface screen is altered if the entity has tampered with the piece of digital evidence but remains unaltered if the entity has not tampered with the piece of digital evidence.

14. The computer readable medium of claim 13 wherein the method further comprises tracking access to the case record.