From Scorched Earth to Precision: A History of Selective Extraction in Digital Evidence

The first rule of digital evidence was simple. Take everything. Image the whole disk, hash it, seal it, and sort out the details later at the lab. For a generation of examiners that was not just a habit. It was a virtue, and it was taught that way through groups like the HTCIA and IACIS, whose imaging procedures promised reliability, completeness, accuracy, and verifiability of computer disk evidence.[1]

The instinct made sense. A bit-stream image is a bit-for-bit copy of the media, blank sectors and deleted files included.[11] Match the hash of the copy to the hash of the original and you have shown that nothing changed. Completeness is the point. Nobody wants to be the examiner who missed the one file that mattered.

Then the volumes outgrew the method. Drives that once held a few gigabytes now hold terabytes, and the arithmetic is unforgiving. At roughly 1.5 GB per minute, a single 1 TB drive can take about eleven hours to acquire before any analysis starts.[7] Even with advances in collection speeds, it’s almost impossible to keep up. Multiply that time across a RAID array, a network share, or a case with a dozen devices and the costs stop being abstractions. They become the reason evidence sits in a queue. In 2014, publicly funded crime labs in the United States reported 7,800 backlogged digital forensics cases.[7]

The cost wasn’t only financial. Copying everything also copies everything that has no business in a case file: unrelated personal data, privileged communications, proprietary material, and the data of bystanders who happened to share a drive. In as early as 2005 I wrote about this issue.[1] My co-author Erin Kenneally and I described the risk of insisting on wholesale acquisition as a kind of electronic bulldozing.[1] A search warrant is supposed to be narrow, particular, and reasonable. A request for “any and all data related to X” reads well in a draft and ages badly in a courtroom.

The paper that asked a different question

In June 2005, Erin Kenneally and I published “Risk Sensitive Digital Evidence Collection” in Digital Investigation.[1] We started from an observation: the field was arguing about completeness versus speed when the real variable was where you do the filtering. The prevailing method collected everything at the front end and filtered at the back end, during examination. We proposed turning that around.

The hallmark of the risk-sensitive approach was filtering and reduction at the acquisition stage rather than after the fact. Two components carried the method: live searching with simultaneous identification of evidence, and selective extraction of low-level supporting artifacts from the media. The paper included an artifact template for Windows 2000 as a concrete example of what “target the artifacts, not the whole disk” looked like in practice.[1]

We were explicit that this was not an abdication of imaging. When the computer is itself an instrumentality or a fruit of the offense, seizure and retention of the whole machine is both permitted and advisable, in the same way a gun used in a robbery is retained as evidence.[1] The risk-sensitive method was meant to complement bit-stream imaging in the large-volume, time-sensitive, network-based cases (we used 200 GB as our threshold then) where the full-copy reflex produces more risk than it retires.[1]

The legal argument underneath was more subtle than “it’s faster.” An examiner who insists on imaging everything can end up with a warrant that overreaches the Fourth Amendment standards of narrowness, particularity, and reasonableness, which puts the evidence at risk in the worst case and makes drafting harder in the best one.[1] On the other side sits the government’s duty to preserve materially exculpatory evidence, the principle behind cases like Brady and Agurs, and the bad-faith standard from Youngblood.[1] We argued the right question is whether law enforcement is constitutionally bound to find every piece of relevant evidence, including exonerating data, and noted that due process imposes no affirmative duty to use the best available technology in every case.[1]

Critics made a fair point in return. Selective collection, done badly, can tunnel on one case type and miss evidence of other criminality, and a partial collection is easier to second-guess than a complete one. Researchers and practitioners have argued that if the difference comes down to hours or days, a full image may still be the more defensible choice.[10] Both are true. The method is not a shortcut. It is a trade made on the record.

The tools caught up

For years the theory ran ahead of the tooling. That gap has closed.

Logical acquisition, which copies a defined set of files or artifacts rather than the whole device, and selective acquisition, which targets a subset such as photos or contacts, are now standard vocabulary.[8] Case-type filtering, sometimes called sniper forensics, became a practical technique, with the same tunnel-vision caveat attached.[10] On-scene triage tools now let an investigator with limited time decide what is worth a full image and what is not.

The formats matured too. Proprietary logical containers like L01, Lx01, AD1, and X-Ways Evidence Containers have been joined by an open one. In 2019 Bradley Schatz introduced AFF4-L, an extension of the AFF4 evidence container built for logical imaging.[3] AFF4-L stores file content with deduplication, keeps arbitrary metadata such as original path and file birth time, and can be opened with ordinary ZIP tooling. It is a genuinely open specification with a reference implementation, which matters when the container has to outlive the tool that made it.[3]

The surrounding ecosystem has moved with it. AFF4 became a DFRWS-supported project.[2] Vendors implemented AFF4-L, though interoperability between independent implementations has been uneven enough to need workarounds.[2] Standards bodies are now in the picture: the EU E-Evidence Package and ETSI TS 103 643 define how logical material is exchanged with its authenticity, integrity, and provenance intact.[2][13] ETSI TS 103 643 goes further and specifies the time information a Digital Evidence Bag must carry, including an entry timestamp for when the material was received.[9] The goal across all of it is the same: collect less, and prove the collection is trustworthy.

Hashes are necessary. They are not sufficient.

Hashing is the cornerstone of digital forensics, and it deserves to be. But the field has a blind spot at the end of the process, where the reflex is to hash the image, record the value, and consider integrity solved.

Two problems sit there. The first is that the classic algorithms have decayed. MD5 and SHA-1 have been broken, and the 128-bit space of MD5 has a birthday bound that a sufficiently large file population can reach.[11] The second problem is quieter. A hash proves the bytes are unchanged since the hash was computed. It says nothing about when that happened. A determined actor can repackage a container after tampering, or compute a hash long after acquisition and present it as if it were contemporaneous. Integrity without time is half a guarantee.

The container itself is part of the answer. AD1, L01, and Lx01 long ago provided a single container hash that captures the whole image. AFF4, in its published implementation, did not: it recorded a hash per segment, which detects corruption but leaves the practitioner to store every file’s hash to prove the container as a whole is intact, which is unwieldy beyond a handful of files.[2] A 2026 proposal fixes this by defining a container hash as the hash of the container’s information.turtle metadata file, stored inside the container and recorded externally in the investigator’s notebook, chain-of-custody forms, or evidence management system. Verification then runs as a short chain: compare each file’s bytes to its recorded hash (catches corruption), compare the metadata file to the container hash (catches incomplete tampering), and compare the stored container hash to the one in your notes (catches tampering, a wrong container, or a documentation error).[2] Schatz has proposed the same container-hash concept in a draft of the AFF4-L specification, which is the kind of convergence that usually precedes adoption.[2]

The missing half: trusted timestamps

This is where RFC 3161 comes in, and where many otherwise careful examiners stop short.

RFC 3161 defines the Time-Stamp Protocol. A Time Stamping Authority, acting as a trusted third party, takes the hash of your data and returns a signed token that proves the data existed before a particular moment.[4] The token binds a trustworthy time value to your hash under the TSA’s signature, which is exactly the proof a hash alone cannot provide. That is non-repudiation of existence at a point in time, and it is the piece that closes the gap between integrity and authenticity.

The implementation is more accessible than its reputation suggests. FreeTSA.org runs a free RFC 3161 authority reachable through standard OpenSSL commands, so an examiner can create a timestamp query from a file’s hash, submit it, and receive a verifiable response without a commercial contract.[5] Sectigo offers a commercial timestamping service that supports RFC 3161 and an eIDAS-qualified variant for work that needs it.[6] The technique scales to whole cases: timestamp a single aggregate file that lists the hashes of every collected file, and you have proven that all of them existed before that one moment, provided the aggregate and the files are available at verification time.[5]

The reason this matters legally is that timestamps are no longer optional. ISO/IEC 27037, the guideline for digital evidence acquisition, expects every piece of evidence to carry a verifiable, independent time reference, and under eIDAS a qualified timestamp carries a presumption of accuracy.[12] If your chain of custody documents a hash but not a trusted timestamp, you have proven the evidence is unchanged and left the question of when to educated assertion. Hash and timestamp the container hash, or a manifest of per-file hashes, at the moment of collection, and the temporal question goes away.

What this means for examiners

If you are new to the field, the takeaway is not that you should collect less so much as that you should collect with intent and document the intent. Decide what matters, write down why, hash it, timestamp it, and keep the manifest with the case file. Selective extraction is defensible when it is a documented risk decision, and fragile when it looks like time saved. Learn the vocabulary early, since logical and selective acquisition are now the language that reports and courts expect.[8]

If you have been in this work since the days when a large case meant 200 GB, the ground has shifted under the arguments you used to have. The legal analysis that made front-end filtering controversial in 2005 has been tested, the open formats that made it practical now exist, and the standards that make selective images exchangeable and verifiable are in force.[1][2][9] Adopt them deliberately, because a logical image that cannot prove its own authenticity is weaker than the full image it replaced.

And keep the older tool ready. When the device is the instrumentality, when the media is small, or when the lawful scope is genuinely broad, the full bit-stream image remains the right answer. The risk-sensitive method was never meant to replace it. It was meant to give examiners a defensible alternative when the full copy was the riskier choice.[1]

Where this leaves examiners today

The history of selective extraction is a twenty-year arc from trench wisdom to standardized practice. It began with the uncomfortable observation that imaging everything had become its own liability, and it ends with open formats, container hashes, and trusted timestamps that let an examiner collect less while proving more.

The principle underneath has not changed since 2005. Collect with intent, prove integrity, prove time, and be able to explain the choice. Scorched-earth collection was never really about thoroughness. It was about not having to decide. The challenge now is in deciding well, and in leaving a record that stands up when someone asks why.

Sources

[1] E. Kenneally and C. L. T. Brown, “Risk Sensitive Digital Evidence Collection,” Digital Investigation, vol. 2, no. 2, pp. 101–119. @url:https://www.researchgate.net/publication/223035867_Risk_sensitive_digital_evidence_collection, June 2005, Last accessed October 3rd 2026

[2] F. Servida (with contributions by E. Casey), “Introducing Container Hashes for AFF4-L,” DFRWS. @url:https://dfrws.org/introducing-container-hashes-for-aff4-l/, September 19th, 2026, Last accessed October 3rd 2026

[3] B. L. Schatz, “AFF4-L: A Scalable Open Logical Evidence Container,” DFRWS USA 2019. @url:https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-aff4_l_a_scalable_open_logical_evidence_container.pdf, July 2019, Last accessed October 3rd 2026

[4] C. Adams, P. Cain, D. Pinkas, and R. Zuccherato, “Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP),” IETF RFC 3161. @url:https://www.ietf.org/rfc/rfc3161.txt, August 2001, Last accessed October 3rd 2026

[5] FreeTSA.org, “Free Time Stamp Authority.” @url:https://www.freetsa.org/index_en.php, Last accessed October 3rd 2026

[6] Sectigo, “Time-Stamping Server and Stamping Protocols.” @url:https://www.sectigo.com/resource-library/time-stamping-server, Last accessed October 3rd 2026

[7] National Institute of Justice, “New Approaches to Digital Evidence Acquisition and Analysis.” @url:https://nij.ojp.gov/topics/articles/new-approaches-digital-evidence-acquisition-and-analysis, Last accessed October 3rd 2026

[8] National Institute of Standards and Technology, “Digital Investigation Techniques: A NIST Scientific Foundation Review,” NIST IR 8354. @url:https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf, February 2022, Last accessed October 3rd 2026

[9] ETSI, “Digital Evidence Bag (Digital Assurance),” ETSI TS 103 643 V1.2.1. @url:https://www.etsi.org/deliver/etsi_ts/103600_103699/103643/01.02.01_60/ts_103643v010201p.pdf, January 2022, Last accessed October 3rd 2026

[10] Australian Institute of Criminology, “Storage, intelligence, review and archive (data reduction framework),” TANDI 480. @url:https://www.aic.gov.au/sites/default/files/2020-05/tandi480.pdf, May 2020, Last accessed October 3rd 2026

[11] ScienceDirect, “Forensic Image (topic overview).” @url:https://www.sciencedirect.com/topics/computer-science/forensic-image, Last accessed October 3rd 2026

[12] TrueScreen, “Digital timestamp: guide to legal-grade time certification.” @url:https://truescreen.io/insights/digital-timestamp-legal-grade-time-certification/, Last accessed October 3rd 2026

[13] European Commission, “EU E-Evidence Package: Commission Guidance on contingency arrangements.” @url:https://commission.europa.eu/document/download/1a0a704c-42b5-4ed0-a440-e4227eb0ec40_en, Last accessed October 3rd 2026