Documenting chain of custody

Purpose and when to use it

Start the record at collection and continue through working copies, transfers, analysis, storage, and disposition. Include automated processing where it changes objects or their locations.

Evidence required

Identify each original and derived object, its acquisition source, storage location, handler, byte length, digest, transfer event, and relationship to earlier objects. Protect private identifiers while retaining internal traceability.

Principles and procedure

• Create an evidence ID and record acquisition, responsible handler, and initial integrity measurement.
• Record each transfer, receipt, access boundary, and integrity check with its time source.
• Give derivatives separate IDs and record their inputs, transformations, tool versions, and output digests.
• Investigate gaps or mismatches, preserve the discrepant objects, and document any correction without erasing the earlier record.

What to document

A custody event should name the object, action, responsible party or process, time, purpose, and result. Storage controls and transfer receipts belong in the supporting record.

Failure modes

Renaming or editing a file without recording the relationship can break traceability. Shared accounts obscure responsibility, and a hash copied from an unrelated object does not repair a custody gap.

Limits on the conclusion

A complete custody log supports handling continuity but does not establish that the original content was truthful. A gap requires assessment in context rather than an automatic claim of tampering.

Independent checks and corroboration

Compare retained objects, transfer receipts, independent storage logs, and digest measurements. Investigate whether a mismatch is an intentional derivation, a wrong identifier, or an unexplained change.

How to report the result

Explain custody coverage and material gaps. Publish only the minimum necessary handling detail and describe redactions that affect independent inspection.

Related methods

• The complete evaluation method
• Preserving synthetic evidence
• Reporting synthetic-evidence findings

Related glossary terms

• chain of custody
• derived evidence

What belongs in a transfer record?

Record the object identifier, parties, time, purpose, transfer method, storage destination, and integrity checks. Keep originals and derivatives separate and document any authorized transformation or exception during handling.

A transfer receipt and matching digest address different parts of continuity. Preserve both so the account explains who handled the object as well as whether the compared bytes changed.