A custody record explains what happened to the evidence
Chain of custody concerns documented handling: who held an item, where it was stored, what was done to it, and how it moved between responsible parties. A digest is one useful measurement within that history. It does not replace the history.
For AI-related evidence, the item might be a media file, an export, a database set, or a collection of tool records. Describe the acquired object and collection scope before treating a later analytical representation as the same evidence item.
Separate the acquired item from its derivatives
| Evidence or distinction | What it supports | Limit or next question |
|---|---|---|
| Acquired representation | The item obtained through the documented collection method. | Record source, scope, and handling context. |
| Preserved copy | A retained representation used to maintain continuity. | Document comparison and storage. |
| Working copy | An object used for examination. | Record consequential operations that can alter it. |
| Analytical derivative | A transcript, conversion, graph, or report generated from source evidence. | Retain the transformation and relationship to inputs. |
What does a matching digest actually say?
With an identified algorithm and a properly performed comparison, matching digests support a byte comparison between the measured objects. They do not establish who created the object, whether it depicts a true event, or whether collection omitted other relevant files. FIPS 180-4 is the technical source for the hash algorithms. FIPS 180-4: Secure Hash Standard.
A digest measured after acquisition cannot retroactively document everything that happened before acquisition. State the measurement point and the object covered. A folder listing or selected export needs a defined representation before its integrity can be compared meaningfully.
An audio conversion changes the bytes without breaking the history
Hypothetical example: an acquired recording is converted into a format supported by an examination tool. The converted file has a different digest. That is an expected consequence of producing a derivative, not by itself a custody failure.
Preserve the acquired recording, identify the conversion and relevant settings, and link the derivative to its input. Record which object the tool examined. The report can explain both continuity of handling and the limitations introduced by the conversion.
What should a handling gap do to the conclusion?
A gap should be described and assessed for the proposition being made. An undocumented transfer may matter differently from a documented read-only examination. Avoid claiming that one gap automatically proves manipulation, or that a later matching digest makes every earlier gap irrelevant.
Consider ordinary explanations and available corroboration. Storage records, transfer receipts, and independently acquired copies may help clarify continuity. Explain what those records support and where their coverage ends.
What does custody establish?
A documented history supports accountability and continuity within its scope. It helps a reader assess whether consequential handling and transformations were recorded. NIST SP 800-86 supplies general preservation and handling context. NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response.
Custody does not guarantee truthful content, a complete source collection, or legal admissibility. Those are separate questions. This page explains the concept; the linked method guide provides the procedural reference.
How the sources support this guide
Source comparison: 2026-10-14. Technical concepts, supporting context, and editorial reasoning are distinguished below.
| Concept | Support | References and limits |
|---|---|---|
| Handling and copies | Direct concept | NIST SP 800-86 — full publication SP 800-86 §§3.1.2 and 4.2.1 describe handling documentation and examination of copies. |
| Digest comparison | Direct concept | FIPS 180-4: Secure Hash Standard; NIST SP 800-86 — full publication FIPS 180-4 defines algorithms; SP 800-86 §4.2.2 supplies evidence-integrity comparison context. |
| Transformation and custody gaps | Editorial interpretation | PROV-DM: The PROV Data Model; NIST SP 800-86 — full publication The audio example is hypothetical. Assessing the impact of a handling gap depends on the claim and actual records. |
Citation and editorial context
This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.
Examples are hypothetical. See the editorial policy, methodology, and correction process.
Shelley, Jesse (ed.). “Chain of custody: handling history beyond a matching hash.” Synthetic Forensics, 1.1.0-citation-review-1, 2026-10-14. https://syntheticforensics.org/glossary/terms/chain-of-custody/ Accessed: add the date you consulted this page.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86 — full publication
Sections 3–8 and Appendix B cover collection, handling, files, operating systems, applications, and correlation. Published August 2006; AI-specific terminology is not defined here.
- FIPS 180-4: Secure Hash Standard
Cryptographic digest algorithms, including SHA-256. The official page records a planned revision; a digest alone does not authenticate an origin.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
Canonical reference: https://syntheticforensics.org/glossary/terms/chain-of-custody/
Report a technical correction