A county wants memory images hashed and cataloged by workflow before analysts review them. What forensic automation practice is that?

A county that wants memory images hashed and cataloged by workflow before analysts review them is automating forensic artifact intake so memory images are hashed and cataloged before civic analyst review. Intake controls establish chain-of-custody hygiene: cryptographic hashes, case identifiers, timestamps, and storage locations are recorded before anyone opens the dump. That order protects integrity claims, reduces accidental modification, and lets multiple analysts trust they are examining the same artifact the collector sealed.

Why the other options fail by concept: Automating chain-of-custody attestation so memory images are hashed and cataloged before civic analyst review names the formal attestation, not the intake action — attestation certifies custody after intake controls are done instead of creating the cryptographic hash, case ID, timestamps, and storage record that seal the artifact before anyone opens it. Automating evidence preservation workflow so memory images are hashed and cataloged before civic analyst review describes broad protection and retention, not intake — preservation prevents alteration and loss during storage instead of creating the case ID, timestamps, and storage location record the county requires to make the image ready for pre-review analyst use. Automating timeline reconstruction output so memory images are hashed and cataloged before civic analyst review confuses analysis with intake — timeline reconstruction orders events from already-intaked artifacts during analysis, not the integrity controls that must exist before analyst review.

Exam caveat: hashing and cataloging prove integrity of the stored object, not that collection itself was authorized or complete; authorization and scope remain separate gates. Operational check: enforce a SOAR or forensics workflow step that refuses analyst review access until hash, case ID, and catalog record exist, and spot-check county memory intakes for missing metadata each month.