Create 01-evidence-handling.md

Author: ngvuthdanhh

operations/01-evidence-handling.md

@@ -0,0 +1,28 @@
+# 01 — Evidence Handling
+
+## Chain of Custody Workflow
+- Record acquisition time, location, and handler.
+- Maintain an unbroken handoff log.
+- Use tamper-evident storage methods.
+- Document all actions taken on evidence.
+
+## Integrity Validation
+- Hash evidence before and after imaging.
+- Compare checksums to validate integrity.
+- Store hashes in the case record and report.
+
+## Imaging Workflow
+- Determine logical vs physical collection.
+- Avoid interacting directly with original media.
+- Use write-blocking in all acquisition steps.
+- Store clean copies and work only on duplicates.
+
+## Storage Strategy (3-2-1 Model)
+- 3 total copies  
+- 2 different storage mediums  
+- 1 off-site copy  
+
+## Evidence Isolation Checklist
+- Disconnect compromised systems from networks.
+- Prevent system modifications.
+- Restrict access to minimal authorized personnel.