Chain of custody

What the record has to show#

A defensible chain of custody answers four questions about every moment of an item's life in your possession: who had it, where it was, what was done to it, and how the answer to each is verifiable. In practice that means a custody form that travels with the item, signed at every transfer, plus the acquisition log the imaging tool produces on its own.

The form is the part people remember. The tool logs are the part that survives cross-examination, because they were generated by software rather than written by the person being questioned.

Why digital evidence makes this harder#

Physical evidence has a useful property: you can only be holding it in one place. Digital evidence does not behave that way. A copy is indistinguishable from the original, copies can be made silently, and simply opening a file can change its metadata. That is why a forensic workflow separates acquisition from analysis — the working copy is what gets examined, and the original is sealed and never touched again.

It is also why the hash value matters so much here. A cryptographic hash taken at acquisition, and re-verified before analysis, is what lets an examiner testify that the thing they analysed is bit-for-bit the thing that was seized. Without it, the custody form asserts continuity; with it, the continuity is demonstrable.

Where chains actually break#

In our experience the failures are rarely dramatic. They cluster in a few ordinary places:

• Self-collection. A custodian is asked to "send over anything relevant" and does so by dragging files into a folder. Access and modification timestamps change, no acquisition record exists, and there is now no way to show what the original looked like.
• The gap before counsel is involved. IT images a laptop the week the employee resigns, in good faith, using a backup tool rather than a forensic one. The data may be fine; the record of how it was obtained is not.
• Undocumented transfers. The drive goes from the examiner to a colleague to a vendor. Each step was legitimate and none was written down.
• Storage that nobody can describe. Evidence sits in an office drawer or a shared cloud folder for four months and no one can say who had access.

What a challenge looks like#

Opposing counsel does not usually argue that evidence was fabricated. The more effective attack is narrower: establish that the record has a hole, then invite the court to decide what could have happened inside it. Because the standard is about reliability rather than proof of tampering, an examiner who cannot account for a period does not need to be accused of anything for the evidence's weight to suffer.

The practical consequence is that chain of custody is not paperwork you complete after the analysis is interesting. It is the thing that determines whether the analysis is usable at all, and it has to be right before anyone knows whether the evidence helps.

If a chain is already broken#

It is not automatically fatal, and pretending the gap does not exist is worse than the gap. Courts have admitted evidence with imperfect custody records where the proponent could show, by other means, that the evidence was what it purported to be — corroborating logs, hash values recorded elsewhere, testimony about the actual handling. The work is reconstructive and it is far more expensive than doing it correctly the first time. Tell your expert early; a break disclosed by your own witness is a manageable problem, and one discovered on cross is not.