---
title: "Digital evidence handoff record"
type: worksheet
publisher: Yenra
source: "https://yenra.com/computer-forensics/"
created: 2026-10-17
updated: 2026-10-17
version: "2026-10-17.2"
tags:
  - yenra
  - worksheet
  - computer-forensics
status: not-started
---

# Digital evidence handoff record

Purpose: Give an authorized responder useful observations and custody context.
Complete what is known; label uncertainty. Do not collect new material, search
personal devices or alter evidence merely to fill this form. Follow the incident
lead's instructions and obtain appropriate authority before collection.

How to use: Enter details after each colon. Check a field once its details are
recorded, including any explicit unknown or not-applicable status. For the final
handoff checks, tick only statements you have confirmed. In Obsidian, switch to
Reading view to click the checkboxes; return to Editing view to fill in details.

## Case and authority

- [ ] Private case reference / coordinator / trusted contact route:
- [ ] Investigation question and business impact:
- [ ] Authorized scope / approver / legal or preservation instructions:
- [ ] Responder and agreed next step:

## Observation

- [ ] Observed date / time / time zone; estimated or exact:
- [ ] Observer and what they directly saw:
- [ ] Device or service / tenant / account / private inventory reference:
- [ ] Exact visible alert or event reference:
- [ ] Interpretation or hypothesis, kept separate from observation:
- [ ] Known log-retention deadline / unknowns:

## Item record (repeat for each item)

- [ ] Item identifier / description / source:
- [ ] Original, preserved copy or working copy:
- [ ] Collected by / authority / date / time zone / method:
- [ ] Tool and version, if supplied by the examiner:
- [ ] Hash algorithm and digest, if supplied; exact item hashed:
- [ ] Protected storage location / access owner:
- [ ] Handling limitations or gaps:

## Custody and action log (repeat each row)

| Date/time/zone | Person | Item | Action or transfer | Purpose | Result |
| --- | --- | --- | --- | --- | --- |
| | | | | | |

- [ ] Recipient acknowledgment / receipt reference:
- [ ] Previously performed containment, scans, restarts, copies or cleanup:

## Handoff check

- [ ] Observations distinguished from conclusions.
- [ ] Prior actions and uncertainty recorded.
- [ ] Originals and working copies distinguished.
- [ ] Recipient, authorized transfer method and acknowledgment confirmed.
- [ ] Follow-up owner and deadline assigned; credentials handled separately.

Source context: NIST SP 800-86 (2006), NIST SP 800-61r3 (2025), and CISA
ransomware guidance linked in the guide. This record does not certify legal
admissibility or replace a qualified examiner's acquisition procedures.