Digital evidence is only as good as its history. A perfectly authentic file can lose much of its weight if you cannot show where it came from, who handled it and what happened to it in the meantime. The chain of custody is exactly that: continuous, unbroken documentation of every step an exhibit goes through, from the moment it is identified until it is presented.
Why it matters so much with digital data
With a physical object, a knife or a paper document, tampering often leaves visible marks. Data is different. A file can be changed without any apparent trace, and two identical copies cannot be told apart by eye. In the digital world, reliability is not visible: it is proven through documentation.
A patchy chain of custody hands the other side a simple argument: "nobody can guarantee this data was not altered". Even if the claim is baseless, answering it becomes difficult.
The elements of a sound chain of custody
Unique identification of the exhibit
Each item receives a unique code, for example a sequential number linked to the case. The code goes on a label attached to the item or to the bag that contains it, and in every later document. You record make, model, serial number, capacity, colour and any visible damage.
Description of the initial state
You record the condition of the device: on or off, locked or unlocked, connected to a network or not, and battery level. Photographing the device from several sides, including the screen if it is on, is a simple and very useful habit.
Transfer log
Every time the exhibit changes hands you record:
- date and time of the transfer;
- name of the person handing over and of the person receiving;
- reason for the transfer;
- condition of the exhibit and its seals;
- signatures of both parties.
Integrity fingerprints
For digital copies, a hash value is calculated at the time of acquisition and recalculated at every later check. If the value matches, the data is identical bit for bit. The hash must be written in the record, not just saved in a file next to the copy.
Physical storage
Exhibits should be kept in an access-controlled location, in antistatic bags or sealed containers. Numbered seals, or at least signatures written across the closure, reveal unauthorised opening.
A sample log
| Date and time | From | To | Reason | Seal status |
|---|---|---|---|---|
| 12/03, 10:15 | IT manager | Forensic consultant | Acquisition | Intact, no. 0041 |
| 12/03, 16:40 | Forensic consultant | Secure cabinet | Storage | New seal no. 0042 |
| 20/03, 09:05 | Secure cabinet | Forensic consultant | Hash check | Intact, no. 0042 |
A table like this, filled in consistently, answers in advance the questions anyone might ask.
Common mistakes
- Leaving time gaps: the device sat on someone's desk for days with no record at all.
- Vague entries: writing "handed to the technician" without name, time or signature.
- Working on the original: analysing the seized drive directly instead of a copy, altering its metadata.
- Late hashing: the fingerprint must be calculated during acquisition, not days later.
- Untracked copies: making working copies without logging them, so nobody knows how many exist or where they are.
Chain of custody for online data
When the evidence is not an object but content on the internet, the principle is the same; only the form changes. You document who performed the capture, with which device and connection, at what time, which addresses were visited, where the resulting files were saved and with which hashes. Here too, every later copy must be traceable.
Matching the documentation to the case
You do not need a lab with secure cabinets for a minor dispute. You do need consistency: a notebook with numbered pages, a sealed and signed envelope, a log file with the hashes and one responsible person are often enough. What matters is that the exhibit's history is complete and that anyone reading it can understand what happened.
What to do if the chain is already broken
Sometimes you receive material that has passed through several hands with no records at all. In that case, do not pretend the chain is intact. It is more correct to write down what is known, with statements from the people involved, and from that point on apply the procedure rigorously. An honest account of the limits is more credible than documentation rebuilt after the fact.
In short
- The chain of custody documents every step of an exhibit without gaps.
- Each exhibit must be uniquely identified, photographed and described.
- Every transfer needs date, time, names, reason and signatures.
- Hash values must be calculated immediately and written in the record.
- If the chain is already broken, say so openly rather than hiding it.