Casey Anthony Trial (2011) — Chain of Custody & Hashing Failure

Prosecution introduced web browser searches for 'chloroform' found on the family computer. The defense challenged the chain of custody because the hard drive was not sealed immediately.

## Background

Prosecution introduced web browser searches for 'chloroform' found on the family computer. The defense challenged the chain of custody because the hard drive was not sealed immediately.

## Learning Objective
Understand bit-stream imaging, cryptographic hashing (MD5/SHA-1), and maintaining an unbroken chain of custody.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: Casey Anthony Trial (2011) — Chain of Custody & Hashing Failure
- Year: 2011
- Domain: Cyber Forensics
- Difficulty: Intermediate

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-casey-anthony

## Investigation Questions

1. What was the chain-of-custody error in the Casey Anthony trial?
2. How does cryptographic hashing (MD5/SHA-1) protect evidence integrity?
3. Why was the chloroform search evidence challenged despite being forensically sound?
4. Create a chain-of-custody form that would have prevented the defense argument.
5. How do hash mismatches affect evidence admissibility in court?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Document EVERY touch. If you sneeze near the evidence, log it. The case is won or lost in the paperwork, not just the software.

## Forensic Takeaway
If the hash values don't match the original seizure log, the evidence is inadmissible. Procedural errors kill otherwise perfect digital evidence.