Chain of Custody

The chain of custody is the unbroken, chronological documentation showing the seizure, custody, control, transfer, analysis and disposition of a piece of evidence — from the moment it is acquired until it is presented in court and beyond. It records who handled the item, when, why, and what was done to it, so that the party offering the evidence can prove it is the same item that was collected and that it has not been altered, substituted or tampered with.^[1]

Chain of custody is a requirement of the rules of evidence and a central pillar of digital forensics, but it applies to every kind of evidence — a paper document, a hard drive, a blood sample, a seized ledger. For fraud and financial-crime investigators it is the discipline that converts a recovered file or a boxed set of records into something a court will accept.

1 Definition and purpose

The purpose of the chain of custody is authentication: to establish that the item offered in evidence is what its proponent claims it to be, and that it is in substantially the same condition as when it was collected. Under the rules of evidence, a party cannot simply produce a document or a disk and assert its relevance; it must first lay a foundation showing where the item came from and how it was handled. The chain of custody is that foundation.^[2]

A complete chain answers four questions for every stage of an item's life: who had it, from when to when, for what purpose, and how it was stored or secured in the interim. Each transfer between custodians is a link; if every link is documented and every custodian can account for the item while it was in their care, the chain is unbroken.

2 Why gaps make evidence inadmissible

A gap in the chain — an unexplained period during which an item's whereabouts or handling is undocumented — opens the door to the argument that the evidence could have been altered, contaminated or swapped. Opposing counsel does not have to prove that tampering actually occurred; it is often enough to show that it could have, and that the proponent cannot rule it out. Faced with such doubt, a court may exclude the evidence entirely, or admit it while allowing the jury to give it little weight.^[1]

This is why chain-of-custody failures are so damaging: they rarely turn on whether the underlying data is genuine, but on whether the investigator can prove it is genuine. A technically flawless forensic image is worthless in court if the investigator cannot account for the drive between seizure and imaging. In digital forensics the standard formulation from ISO/IEC 27037 captures the same idea in three words — an investigation must be auditable, repeatable and reproducible.^[3]

3 Maintaining the chain

Maintaining an unbroken chain is a matter of disciplined, repetitive procedure rather than technical sophistication. Standard practices include:

• Labelling and unique identifiers — every item receives a unique evidence number, tag or barcode at the point of collection, along with a description, date, time and location.
• Custody logs — a written or electronic log records every person who takes possession of the item and every transfer, with signatures, dates and reasons. Nothing changes hands without an entry.
• Cryptographic hashes — for digital evidence, a hash value (MD5, SHA-1 or SHA-256) is computed at acquisition and re-verified at each stage, giving mathematical proof that the data has not changed. See Digital Forensics.
• Multiple copies — investigators create verified forensic copies and preserve the original in secure storage; routine work is done on copies so the original is touched as little as possible.
• Work on images, not originals — all analysis is performed on a working copy of a forensic image. The original media is sealed and stored, its hash on record, ready to be re-imaged if a copy is ever challenged.
• Secure storage — evidence is kept in access-controlled storage (a safe, a locked evidence room, or an access-logged server), and the storage itself is part of the documented chain.

4 Digital evidence specifics

Digital evidence poses a particular challenge because it can be altered invisibly and without leaving obvious traces. Merely opening a file or booting a suspect computer can change timestamps and system state. The chain-of-custody answer is procedural: acquire with a write-blocker, hash immediately, image bit-by-bit, and thereafter work only on verified copies. The hash recorded at acquisition becomes the anchor of the entire chain — if the same hash can be reproduced later, the data demonstrably has not changed. These practices are codified in ISO/IEC 27037, NIST SP 800-86 and SWGDE guidance.^[3]

Cloud and third-party data complicate matters: the investigator may never have physical custody of the storage, so the chain must instead document the request, the provider's export process, and the receipt and hashing of the exported data. Business records obtained from a bank or a company are handled similarly, with a custodian's declaration standing in for physical seizure.

5 Relationship to testimony

The chain of custody ultimately exists to support testimony. At trial, a witness — often the investigator or an evidence custodian — will testify to how the item was collected and handled, and the custody log supports that account. If the evidence is analysed by a forensic examiner, that examiner's report and testimony rest on the assumption that what they analysed is authentic; the chain of custody is what makes that assumption defensible. A well-kept chain therefore protects not only the evidence but the credibility of everyone who touched it.

See also: Digital Forensics, Evidence and Testimony, Document Examination, Report Writing.

References

1. Maras, M.-H. "Computer Forensics: Cybercriminals, Laws, and Evidence." 2014 (chain-of-custody and admissibility).
2. AICPA. Federal Rules of Evidence 901 (authentication) and related foundation requirements, as cited in Crain, Hopwood, Pacini & Young, "Essentials of Forensic Accounting," 2015.
3. ISO/IEC 27037:2012, "Guidelines for identification, collection, acquisition and preservation of digital evidence" (auditability, repeatability, reproducibility); NIST SP 800-86. https://csrc.nist.gov/pubs/sp/800/86/final